Why cyber insurance applications ask so many security questions
Cyber insurance helps pay for the cost of an attack: recovery, investigation, notifying affected people, legal costs and sometimes lost income. Because ransomware and email fraud claims became so common, insurers now look closely at how a business protects itself before they offer coverage. The application is often a long security questionnaire, and the answers affect whether you're offered a policy, what it costs, and what it covers.
This quiz covers the controls insurers most commonly ask about. It won't predict a decision or a price — only an insurer can do that — but it shows where you're likely to get stuck, so you can fix things before the renewal date instead of scrambling after.
The controls that matter most
Each question is weighted. Critical controls count three times as much as recommended ones:
| Weight | Controls | Why |
|---|---|---|
| Critical | MFA on email, remote access and admin accounts; EDR; offline or immutable backups; tested restores | These are the controls most often tied to ransomware and account takeover claims, and the most likely to block an application. |
| Important | Closed remote desktop, monitored alerts, patching, no unsupported systems, training, payment verification, email filtering, admin accounts, vendor access, incident response plan | Commonly asked, and often affect price or coverage terms. |
| Recommended | Microsoft 365 backup, phishing simulations, SPF/DKIM/DMARC, no local admin rights, laptop encryption | Good practice that strengthens your application and reduces real risk. |
How to read your result
- Likely ready — you have the controls insurers most often ask about. Gather evidence before you apply: MFA reports, EDR coverage, backup test records, your training log and your written plans.
- Some gaps — one critical control is missing or unconfirmed, or several important ones are. Expect follow-up questions or less favorable terms. Most of these gaps can be closed in weeks, not months.
- High risk — two or more critical controls are missing. Applications in this state are often declined or come with exclusions. Start with multi-factor authentication and backups.
"Not sure" is treated as a gap. That's deliberate: on a real application, you're signing a statement that a control is in place. If you don't know, find out before you sign.
Fixing the gaps: where to start
- Multi-factor authentication everywhere. If you use Microsoft 365, MFA for every account can usually be rolled out in days. Our multi-factor authentication guide covers how.
- Backups attackers can't touch. Add an immutable or offline copy and test a restore. See our backup and disaster recovery guide.
- EDR on every device, with someone watching the alerts. Microsoft Defender for Business, included in Microsoft 365 Business Premium, is one option many small businesses already pay for.
- Training and a payment verification rule. Our free Spot the Phish quiz is an easy way to start the conversation with your team.
- Write the incident response plan. One or two pages is enough: who to call, in what order, and who decides. Include your insurer's claims or breach hotline.
Evidence underwriters may ask for
Saying "yes" on an application is easier when you can back it up. Depending on the insurer and the size of the policy, you may be asked for some of the following, either at application or after a claim:
- MFA: a report or screenshot showing multi-factor authentication is enforced for all users and admins, not just available.
- EDR: a list of protected devices from your security console, matched against your device inventory.
- Backups: the backup schedule, proof that at least one copy is offline or immutable, and the date and result of your last restore test.
- Patching: a patch compliance report showing how quickly critical updates are installed.
- Training: completion records and phishing simulation results.
- Plans and policies: your written incident response plan and payment verification procedure.
If your IT provider can't produce these quickly, that's worth knowing before you sign. It's also exactly what you'd want on hand in the first hours of a real incident.
A note for medical and dental practices
Practices often find that the work overlaps. Multi-factor authentication, encryption, backups, training and an incident response plan all support your HIPAA Security Rule obligations as well as your insurance application. Doing them once, properly documented, covers both.
Questions to ask before you apply or renew
- Can my IT provider produce a report showing MFA is enforced for every user?
- Which devices don't have EDR installed, and why?
- When was our last successful restore test, and how long did it take?
- Do we have any systems that no longer get security updates? (Windows 10 is the common one — see our Windows 10 end of support guide.)
- Which vendors can connect to our systems remotely, and how?
- Does the policy require us to use the insurer's approved incident response firms?
Our cyber insurance requirements checklist goes deeper into each control and the evidence underwriters may ask for, and our ransomware protection guide explains why these controls matter beyond the application. Medical and dental practices should also run our HIPAA security self-assessment, since many of the same controls apply.
Get help with your application
Beefed Up IT puts these controls in place for small businesses and medical and dental practices as part of our managed IT services, and can help you answer the technical questions on an application accurately. See how we hardened security for an accounting firm, or book a free call and bring your gap list.