How to answer your cyber insurance questionnaire

A cyber insurance application has an unwelcome quality. It reads like an examination on a subject the owner and business staff have not studied, it arrives with a renewal deadline attached, and the questions are worded as though the answer ought to be obvious. Reaching question six, realizing you do not know whether the answer is yes, and putting the form down is a common experience.

The form is more predictable than it looks. Insurers concentrate on a short list of controls. That list is usually stable from one insurer to the next, and it is the same list that security guidance for small businesses has recommended for years. This guide explains why they ask, what they ask, and how to answer accurately when the true answer is no.

Why insurers ask these particular questions

An insurer is pricing a probability. It wants to know whether the business is exposed to the incidents behind most cyber losses. Public reporting shows those incidents cluster tightly.

Across all victims, individuals included, the FBI's Internet Crime Complaint Center recorded 1,008,597 complaints during 2025. Reported losses were $20.877 billion, a 26 percent increase over the prior year. Business email compromise alone accounted for 24,768 complaints and more than $3 billion in reported losses. In business email compromise, a criminal uses a real or imitated business email account to redirect a payment. Phishing and spoofing was the largest category by complaint volume, at 191,561 (2025 IC3 Annual Report).

For businesses under 1,000 employees, Verizon's 2025 Data Breach Investigations Report snapshot for small and medium-sized businesses found ransomware present in 88 percent of confirmed breaches, against 39 percent at large organizations. The snapshot covers breaches from November 2023 to October 2024.

Insurers are therefore asking about the specific controls that prevent a stolen password from becoming a claim. The FBI's own list of recommended ransomware mitigations closely matches a cyber application, and it includes the measures below (2025 IC3 Annual Report).

Backups should be held offline or off-site, encrypted, and immutable. Immutable means that no user or intruder can alter or delete them. Default passwords and credentials should be eliminated. Administrative accounts should hold only the access each role needs.

Multi-factor authentication (MFA) adds a second check at sign-in beyond the password. The FBI recommends it "for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems."

The FBI also names endpoint detection and response as a way to detect an intruder inside the network. Networks should be segmented into separate parts, with the traffic between them controlled, which limits how far ransomware can spread. Patching should be prompt, with priority given to software flaws that attackers are already exploiting on systems reachable directly from the internet.

That the questionnaire and the federal guidance ask the same questions is not a coincidence. Insurers and federal agencies are looking at the same incidents, so they arrive at the same short list.

The questions that appear on nearly every application

Wording varies by insurer, but six subjects recur.

Multi-factor authentication. Expect several questions rather than one, because coverage is what matters. The questions cover email, remote access, administrative accounts, and cloud applications. Remote access means reaching the business network from outside the office, for example through a virtual private network (VPN) or remote desktop software. Note the word enforced. There is a meaningful difference between MFA being available to staff and MFA being required of them by policy, and insurers are asking about the second.

Backups. Whether they run automatically, what they cover, whether at least one copy is held offline or in immutable storage an intruder cannot delete, and whether a restore has been tested. The last of those is the question most often answered too generously.

Endpoint protection. Whether devices run endpoint detection and response, or antivirus and anti-malware software, and whether a named person or the IT provider reviews the alerts. Endpoint detection and response is security software on each computer that watches for signs of an attack. NIST's small business guidance frames the same point practically, advising businesses without internal resources to consider "engaging a service provider to monitor computers and networks for suspicious activity" (NIST SP 1300).

Patching and updates. How quickly systems are updated, and whether anything reachable from the internet is kept current. This question has grown in importance. Verizon's 2026 Data Breach Investigations Report, published in May 2026, found that exploitation of a vulnerability was the entry point in 31 percent of breaches. It overtook stolen credentials for the first time in nineteen years.

Incident response. Whether a written plan exists and who owns it. NIST's small business guide describes a short plan. It names a business champion who maintains the plan. It lists each person involved in a response, with their responsibilities and authority. It also records what must be reported, when, and how (NIST SP 1300).

Training. Whether staff receive security awareness training, how often, and whether phishing is covered. In Verizon's 2025 snapshot for small and medium-sized businesses, social attacks accounted for 18 percent of breaches and were "almost exclusively of the Phishing variety." A social attack is one that tricks a person into handing over access or information.

Some applications add questions on wire transfer verification, privileged access management, or supplier security. Privileged access management means controlling and recording who can use administrator access. Answer those questions with the same care: accurately, and with a comment where the form allows one.

How to answer honestly when the answer is no

Answering no is the part that stalls an application, so this point deserves to be stated directly.

Accurate answers, always. An insurance application is a document the business attests is true. A material misstatement is a false or misleading answer that would have changed the insurer's decision or terms. It gives the insurer grounds to reduce or decline a claim at the moment the policy matters. An honest no may cost a premium adjustment or a narrower policy. An inaccurate yes can cost the business its coverage entirely. It follows that "I believe so" is not an answer. Whether MFA is enforced on email takes ten minutes to confirm with the staff member or IT provider who administers your systems. Whether a restore has been tested takes one message to your IT provider. Where the answer depends on the IT provider's work, get the provider's confirmation in writing and keep it.

The qualified answer, where the form allows it. Many applications provide a comment field, and insurers read them. "Multi-factor authentication is enforced on email and on the accounting system. Rollout to remote access is scheduled for March" is a stronger answer than a bare no and a safer one than an unqualified yes. It tells the insurer you know your own position and are moving, which is the signal they are looking for.

Policy versus practice. A control that exists on paper but is not enforced is a no. Insurers increasingly ask for evidence rather than a signed statement. A screenshot from the email system's settings, showing which accounts require multi-factor authentication, settles the question better than a recollection.

Gaps as a plan. A form with four honest nos on it is a plan with four items. It is not a judgment on how you run your business.

How an assessment prepares the answers

The frustration of a questionnaire is not primarily the questions. It is answering them from memory, under time pressure, on a subject where checking your own answers is difficult. An assessment removes that condition.

Working through a structured assessment first means that when the application arrives you are transcribing answers you have already established rather than discovering them. You will know whether MFA is enforced and where, because you looked. You will know when a restore was last tested, because the assessment asks the question and prompts the business to check. You will also hold a prioritized list of what to fix. That list turns the nos on the form into a sequence of dated actions rather than a source of unease at each renewal.

The NIST framework treats insurance the same way, as part of managing risk rather than a substitute for it. NIST's small business guidance lists "assess whether cybersecurity insurance is appropriate for your business" among its recommended governance actions, alongside understanding your legal, regulatory, and contractual obligations (NIST SP 1300).

Two caveats belong here, because the alternative is overselling. No assessment guarantees that an insurer will offer coverage or a particular premium, since insurers also weigh your industry, revenue, claims history, and requested limits. And an assessment certifies nothing. What it gives you is an accurate account of your own position and a plan to improve it, which is what an insurer is trying to establish and what you would want to know in any case.

For the wider picture of how assessments work and when a formal one is warranted, see the small business guide to cybersecurity assessments. If multi-factor authentication or backups are your two honest nos, they are the two highest-value items on the list, and each has its own guide: rolling out multi-factor authentication and backups that survive ransomware.

Before the next renewal

The questionnaire will return at the next renewal, and it is likely to ask more. The businesses that find it straightforward tend not to be the ones with the largest security budgets, but the ones that established their position once, wrote it down, and worked a short list between renewals.

If you do not currently know how you would answer the six subjects above, that is worth resolving before the deadline rather than during it. A self-guided assessment will establish your position across all of them and set the order in which to address the gaps.