Cyber Insurance Readiness Questionnaire & Control Checklist
A working document to ready your cyber-insurance renewal: answer the underwriter's control questions honestly, gather the evidence behind each answer, see the gaps that move your premium, and prepare for a claim. The application is the basis on which the insurer prices and binds the risk — answer it precisely.
01How to use this — and the honesty rule
Use this checklist to prepare and validate every answer before you sign the carrier's application. For each control, record whether it is genuinely in place, the evidence that proves it, and the gap if there is one. Answer the carrier's own questionnaire precisely from this — describe exactly what is covered and name the exceptions.
02Control readiness checklist
The controls underwriters now weigh most. For each: is it genuinely in place, what evidence proves it, and what is the gap and its likely premium/insurability impact? Mark partial coverage as partial — not "Yes".
| Control | In place? (Y / Partial / N) | Evidence | Gap & premium impact |
|---|---|---|---|
| MFA on all remote network access (VPN, RDP, jump hosts) | Y / P / N | IdP config, enforcement policy | e.g. legacy jump host exposed — highest-leverage gap |
| MFA on email / webmail (incl. OWA, M365, Google) | Y / P / N | Conditional-access policy | Blocks the BEC path underwriters price heavily |
| MFA on all privileged / admin accounts | Y / P / N | PAM / IdP report | Often the cheapest, biggest premium mover |
| EDR / XDR on all endpoints and servers | Y / P / N | Console coverage report | Note any ungoverned server group |
| Tested offline / immutable backups, segregated from prod credentials | Y / P / N | Last successful restore-test date | Same-credential replication does not qualify |
| Email filtering / anti-phishing gateway | Y / P / N | Gateway + policy | |
| Privileged-access management (PAM) & privileged-access segmentation | Y / P / N | PAM deployment, tiering model | |
| Network segmentation (flat network increases loss correlation) | Y / P / N | Segmentation diagram | |
| Patch / vulnerability-remediation SLA (esp. internet-facing & critical) | Y / P / N | SLA + vuln-mgmt metrics | |
| Security-awareness training & phishing simulation | Y / P / N | Completion rates | |
| Tested incident-response plan | Y / P / N | Plan + last tabletop date | |
| Centralised logging / monitoring (SIEM or equivalent) | Y / P / N | Log sources, retention |
03Policy terms to understand before you bind
The headline limit is rarely what you collect. Read these terms as the real ceilings on recovery and negotiate them before binding — you cannot fix wording after a loss.
| Term | What to check | Your policy |
|---|---|---|
| Aggregate limit | Total payable across the term | $ |
| Sub-limits (ransomware / extortion, social-engineering fraud, etc.) | Caps carved out below the aggregate for the perils most likely to hit | $ per peril |
| Retention / deductible | First-dollar loss you keep on every claim | $ |
| Coinsurance | Fixed % of a covered loss you share, on top of retention (common on ransomware) | % |
| Business-interruption waiting period | Hours of downtime not indemnified before BI cover begins | hours |
| War / hostile-cyber-activity exclusion | Trigger and the attribution standard for nation-state activity | Wording + carve-backs |
| Widespread-event / critical-infrastructure exclusion | Whether a systemic/correlated event is excluded | Wording + carve-backs |
| Failure-to-maintain-controls / warranty conditions | Whether attested controls are continuing conditions | Wording |
| Notice condition | How soon notice is required ("as soon as practicable") | Deadline / trigger |
| Breach-response panel & consent for non-panel vendors | Whether your own counsel/forensics need prior consent | Panel list / consent rule |
04Claim-readiness steps
Coverage is won or lost in the first hours of a claim. Pre-stage these so a loss does not forfeit the payout.
- Give notice promptly, per the policy's notice condition — late notice is a common, valid ground to reduce or deny a claim; do not wait for full scope
- Use the insurer's pre-approved breach-response panel, or get written consent before engaging non-panel counsel/forensics — unapproved vendor spend risks non-reimbursement
- Keep your own privileged coverage counsel in the room while clearing the coverage path
- Preserve evidence, logs and the decision trail from the first hour; do not alter systems in ways that destroy forensics
- Do not reconfigure or falsely represent a lapsed control after a loss — that converts a defensible dispute into fraud
- If the insurer issues a reservation-of-rights letter, respond on the record: was the represented control actually breached, did any gap cause this loss, and does the exclusion's wording reach these facts?
- Have the application and this checklist on hand — a disclosed exception is your shield against a "misrepresentation" argument
05Pre-renewal gap-closure priorities
Rank the gaps from the checklist by premium/insurability impact against cost, and fund the cheapest high-impact ones before the application goes in.