The cyber insurance application, question by question

Cyber insurance applications used to be a signature. Now they are a questionnaire, and the answers become part of the policy. When a claim comes in, the carrier checks whether the answers were true on the day you signed. This checklist walks through the questions nearly every small business form asks, in the order they usually appear.

1. Is multi-factor authentication (MFA) enabled for email?

What it asks. Whether every email account requires a second step, like a code on a phone, in addition to the password. What counts as yes. MFA enforced for every user, including the owner, with sign-in blocked on shared mailboxes, not just offered as an option. The fix if no. Turn it on at the Microsoft 365 or Google admin level so nobody can skip it. This is the single question most carriers treat as a hard requirement.

2. Is MFA enabled for remote access?

What it asks. If anyone can reach the office network, a server, or a desktop from outside, does that path require MFA. What counts as yes. Any VPN, remote desktop tool, or cloud admin portal needs the second step. The fix if no. Either turn MFA on for the remote tool or remove the remote path entirely. Many small offices have an old remote desktop port open that nobody uses.

3. Are backups kept off-site and separate from the network?

What it asks. If the office is hit by ransomware, is there a copy of email and files that the attacker could not also encrypt. What counts as yes. A backup in a cloud service or at another location, with credentials that are different from the everyday logins. An external drive plugged into the server does not count. The fix if no. A cloud backup of Microsoft 365 and of any server or shared drive, with its own login and MFA.

4. Are backups tested?

What it asks. Whether anyone has actually restored a file from the backup. What counts as yes. A test restore on a schedule, with a note of the date. The fix if no. Restore one folder, write down the date and that it worked, and repeat every quarter.

5. Is endpoint protection installed on every computer?

What it asks. Whether each laptop and workstation runs security software that is kept current. What counts as yes. A business security product on every machine, managed from one place so you can see that it is running. The fix if no. Install it on every computer, including the one in the back that only runs the label printer.

6. Are operating systems and software kept updated?

What it asks. Whether updates install on a schedule rather than when someone remembers. What counts as yes. Automatic updates turned on and checked, with old unsupported systems retired. The fix if no. Turn on automatic updates and replace any computer still on an operating system the maker no longer supports.

7. Is email filtered for spam and phishing?

What it asks. Whether there is a filter in front of the inboxes that catches fake invoices and lookalike senders. What counts as yes. The filtering built into Microsoft 365 or Google, turned up from the defaults, or a third party filter. The fix if no. Tighten the built-in filtering and turn on the settings that flag external senders and lookalike domains.

8. Do employees receive security awareness training?

What it asks. Whether staff have been taught what fake emails, texts, and calls look like. What counts as yes. A session at least once a year with a record of who attended. The fix if no. A 45-minute session with a sign-in sheet. Keep the sheet with the insurance file.

9. Are former employee accounts disabled promptly?

What it asks. Whether someone who leaves loses access the same day. What counts as yes. A written step in the offboarding process, and no shared accounts that a former employee still knows the password to. The fix if no. Give every person their own login so there is something to turn off, and shut it off on their last day.

10. Do you use a password manager or enforce strong passwords?

What it asks. Whether passwords are unique and long rather than reused across sites. What counts as yes. A password manager for the business, with staff using it. The fix if no. Set one up, move the shared passwords into it, and retire the spreadsheet.

11. Do you process payments or hold sensitive customer data?

What it asks. How much data is at risk, which sets the premium. What counts as an accurate answer. A realistic count of customer or patient records. Underestimating this is a problem at claim time. The fix. Count honestly and protect what you hold.

12. Have you had an incident in the last three years?

What it asks. Prior losses. Answer truthfully. A denied claim for a misstatement here is worse than a higher premium.

Keeping the proof

For each yes, keep one screenshot or export that shows it. The MFA policy page. The backup dashboard with the last successful run. The test restore note. The training sign-in sheet. Put them in one folder with the date, and update it at renewal. That folder is what turns an application into a defensible one.

If you would rather have someone go through the application with you, check each answer against what is really in place, fix the gaps, and build the folder, that is our cyber insurance readiness project, from $1,500 with the price fixed in writing before we start.