The evidence pack underwriters ask for: checklist

An answer on an application form is a promise. Evidence turns it into a fact the underwriter can rely on. When the proof arrives with the form, the underwriter asks fewer questions and can decide sooner.

The same evidence matters again at claim time. If the insurer later asks whether a control was in place when the policy started, a dated record is your best answer. You can read more about what underwriters look for.

The business

• Attach a current company registration extract.It confirms your legal name, activity and ownership. Underwriters check your sector against the sectors they cover.
• Include an ownership chart showing any subsidiaries.Many forms ask whether another company owns you and which companies need cover.
• Add your latest revenue, split by country.Use your accounts. Revenue from the US or Canada often affects the terms.
• Sign a declaration on past claims and circumstances.List any cyber incidents or claims in the last five years, and anything that could become one. Answer "none" only if there were none.

Access and devices

• Export MFA settings for each access path.Show email, remote access, admin accounts, cloud consoles and the backup console. Name any account left out and the reason.
• Screenshot your endpoint protection console with the device count.The count should match your asset list. Underwriters look for protection on every laptop and server.
• Provide an asset list showing no end-of-life software.Note any exception and the date you will retire it.
• Attach a patch report from the last three months.Show critical and high fixes applied within one month, and faster fixes on systems that face the internet.

Email and people

• Show your email filtering settings.A settings export or a statement from your email provider works.
• Include your SPF, DKIM and DMARC records.A screenshot of the DNS lookup is enough.
• Add a phishing training report from the last 12 months.It should list staff names and dates. Add simulation results if you run them.

Backups and recovery

• Show how backups stay out of an attacker's reach.A diagram or settings export showing offline, immutable or separate cloud backups works. Show that backup admin accounts are separate and use MFA.
• Attach a restore test record from the last six months.Name the system restored, the date, the time it took and the result. A test with no record gives the underwriter nothing to check.
• Include recovery targets and a continuity plan.State how fast each key system must return and how much data you can afford to lose.

Plans, suppliers and data

• Attach an incident response plan that matches your policy.It should say who calls the insurer, how fast, and which steps need the insurer's consent first.
• Include a supplier register with your critical supplier marked.List hosting, cloud and IT providers, with contracts on file.
• Add your record of personal data and the record count.Underwriters use the number of personal records to size your privacy risk.
• Date, name and label every file.For example, "MFA settings, email, 3 October". Undated screenshots raise more questions than they answer.

Broker's tip

Check every piece of evidence against the exact answer it supports. For example, a screenshot that shows MFA on most accounts, with five left out, contradicts a "yes" for all users. Fix the gap or change the answer before you send the pack. Then keep a copy of exactly what you sent, because that is the version the insurer will compare against if you ever claim.