If your business carries cyber insurance, or is about to apply, you have probably seen the questionnaire. Two or three pages of security questions with checkboxes next to them. Most people hand it to whoever handles IT, get back a set of yes answers, and sign it.
That signature is the part worth slowing down for. The application is not a formality. It is a statement of fact about how your business operates, and the answers become part of the contract. If a claim gets filed and the insurer finds that an answer was wrong, you can end up in a dispute about coverage at the exact moment you need it most. Insurers have gone to court to void policies over inaccurate answers about multi-factor authentication.
The problem usually is not dishonesty. It is that the questions use precise technical language, and the person answering them is reading that language loosely. So here is what the common questions are actually asking.
“Do you require multi-factor authentication?”
This is the question that causes the most trouble, because it is really three questions wearing one coat.
Insurers usually want MFA in three specific places: email, remote access into your network, and administrative accounts. A business that turned on MFA for Microsoft 365 email and nothing else has a defensible yes for one of those and a no for the other two. That gap matters, because the remote access path and the admin accounts are exactly how most intrusions actually progress.
Two follow-up questions are worth asking before you check the box. Does every user have it, including the owner and the one executive who asked to be excluded? And are there service accounts or legacy protocols that bypass it entirely? An MFA policy with three exceptions is the same as a door with three unlocked windows.
“Do you maintain offline or immutable backups?”
Almost every business says yes here, and a good number of them are wrong.
Offline means the backup cannot be reached from the network where the attack happens. Immutable means it cannot be altered or deleted for a defined period, even by someone with administrator credentials. A backup appliance sitting on the same network, reachable with the same domain admin account your attacker just stole, is neither one. Modern ransomware goes looking for backups first, because encrypting them is what turns an incident into a payment.
If your backups run to a local NAS and sync to a cloud folder, the honest answer is probably no, or at best partial. That is worth knowing before an underwriter or a claims adjuster discovers it for you.
“Do you use endpoint detection and response (EDR)?”
Traditional antivirus checks files against a list of known bad things. EDR watches for behavior: a process encrypting files rapidly, credentials being dumped, a script reaching out to an unfamiliar address. They are different categories of product, and insurers ask about EDR specifically.
Windows Defender, in its basic form, is antivirus. Defender for Endpoint on the right licensing tier is closer to EDR. The gap between those two answers can be the difference between a policy and a decline, so find out which one you actually have rather than which one you assume.
“Do you have a documented incident response plan?”
Documented is the operative word. Knowing who you would call is not a plan. A plan is written down, names people, and answers the questions nobody can think clearly about at 2 a.m.: who declares an incident, who contacts the insurer, who talks to clients, who has authority to take systems offline, and where the phone numbers live if email is down.
This one is genuinely easy to fix. A two-page document closes the gap, and unlike most items on the questionnaire, it costs nothing but an afternoon.
“How quickly do you apply security patches?”
Insurers want a cadence, usually something like critical patches within 14 to 30 days. The real question underneath is whether anyone is responsible for it and whether anyone checks.
Watch for the systems that fall outside whatever process you have. The line-of-business application server nobody reboots because it breaks. Firewall and VPN firmware, which is a favorite target and rarely on anyone’s patch calendar. Anything still running an operating system past end of support, which no cadence can save.
“Who has administrative access?”
The answer most businesses give is smaller than the true one. Old accounts from departed employees, vendor accounts created during a project years ago, and users who were made local admins to solve a printer problem in 2019 all count. Every one of those is a full-privilege path into your environment.
Pull the actual list before you answer. It is usually a surprise, and it is one of the fastest things to clean up.
What to do with all of this
Sit down with the questionnaire before it is due and answer every question with evidence rather than memory. For each yes, you should be able to say who verified it, when, and how. If you cannot, the answer is a maybe, and a maybe on an insurance application is a risk you are carrying without knowing it.
A no is not a disaster, by the way. Underwriters would rather see an accurate no with a remediation plan than a yes that falls apart during a claim. Several of these items are cheap to fix, and fixing them usually lowers your premium at renewal. The expensive path is signing first and finding out later.
Want an independent read on where you stand?
This is a good chunk of what my IT assessment covers: a straight answer on where your MFA, backups, endpoint protection, patching, and admin access actually stand, in plain language you can take back to your agent. I do not sell security products, insurance, or licenses, and I earn nothing from any vendor, so the answer is only ever what I find.
If you are filling one of these out right now and any of the questions above made you pause, that is the right time to talk.
Book a free 30-minute call and we will go through the questionnaire together.
One note: I am an IT consultant, not an insurance broker or an attorney. Your agent is the right person for questions about coverage and policy language. I am here for what is happening inside your systems.