Cyber insurance application readiness checklist

Most cyber insurance applications stall on the same few questions. The underwriter asks about MFA, backups or patching, the answer is vague, and the quote waits while someone hunts for proof.

Your answers matter twice. They shape the terms you are offered, and they become part of the contract. If an answer proves wrong after a claim, the insurer may look hard at cover. Treat the form as a statement of fact, and keep the proof for every answer. For more on how insurers read your form, see what underwriters look for.

Know your business facts

• Record revenue for the last 12 months and its currencyUnderwriters use revenue to size the risk and the premium. Have the latest accounts or a management report ready to back the figure.
• List every company in your groupMany forms ask which entities you own and who owns you. An ownership chart or a company registry extract answers this on one page.
• Declare sales and customers in the United States and CanadaMany insurers treat North American exposure differently because legal costs there run high. Give the share of revenue, even when it is small.
• Count the personal data records you holdUnderwriters ask for a rough number of records with personal information. A record of processing or a data inventory shows how you reached the figure.
• Name your main website and email domainsInsurers often scan these from outside before they quote. Fix anything obvious, such as an expired certificate, before you apply.

Prove the controls underwriters check first

• Confirm MFA on email, remote access and admin accountsThis is usually the first control an underwriter checks. Export the settings or take console screenshots, and name any account left out.
• Check every device runs paid endpoint protection or EDRUnderwriters want it on every workstation and server. A console screenshot showing device counts is strong evidence.
• Show critical patches go on within a monthMany forms ask how fast you install critical and high severity updates. A patch report or a recent vulnerability scan backs your answer.
• Confirm backups sit offline or in a backup cloud serviceRansomware on your network should be unable to reach them. Keep a config export or a short note from your provider describing the setup.
• Record a restore test from the last six monthsA backup you have never restored is only a hope. A dated test record showing what you restored and how long it took is what underwriters accept.
• Check all staff completed phishing training this yearMost forms ask whether every person trains at least once a year. A completion report from your training tool is the evidence.
• Close remote desktop access exposed to the internetOpen remote desktop is a common route for ransomware, and outside scans find it fast. Put remote access behind a patched VPN or gateway with MFA.

Disclose your history in full

• List every cyber incident from the last five yearsInclude small ones, such as one phished mailbox. An incident found at claim time that you left off the form causes far more trouble than one declared up front.
• Ask senior people about anything that could become a claimAsk each director and senior manager directly. Many policies exclude matters a senior person knew about before cover started, as our guide to cyber insurance exclusions explains.
• Note any regulator contact in the last three yearsInvestigations, fines and complaints to a data protection authority all count. Keep the letters and the outcome together.

Prepare the submission

• Name one person who owns the applicationQuestions from the underwriter go to one place and get answered quickly. That person checks and signs off the final answers.
• Store each piece of evidence with a dateUnderwriters and claims teams care about when the proof was true. A folder of dated files saves days at renewal and at claim time.
• Read every answer back before you signCheck that "yes" means yes for every user and every device. Where the true answer is "mostly", say so, and give the gap and the date you will fix it.
• Keep a copy of the signed form and evidenceIf you claim, the insurer compares what happened with what you declared. Your copy shows exactly what you said and when.

Broker's tip

The applications that move fastest explain their gaps. An underwriter can work with "MFA covers all staff, and our two shared kiosk accounts get it by the end of next month". A blanket "yes" that later proves wrong is far harder to fix. Honest detail with a date usually earns more trust than a perfect score on paper. Ask your broker how a given insurer treats planned improvements.