Cyber insurance questionnaires: the controls insurers ask about

The renewal arrives, and with it a questionnaire full of IT terms. Do you enforce multi-factor authentication for all remote access? Do you run endpoint detection and response? Are backups kept offline or immutable? Whoever fills it in is often the office manager, guessing at answers on a deadline.

Those answers matter. They can affect whether you get coverage, what it costs, and how a claim is handled later. This post explains the controls that commonly appear on these forms in plain terms, so you can check what you really have before you sign. It covers IT practices only. Your broker and your policy wording decide what is covered.

Multi-factor authentication

MFA questions are usually the most detailed. Insurers often ask about it separately for email, remote access, admin accounts and cloud apps, because a stolen password is one of the most common ways attackers get in.

1. List every way staff sign in from outside the office: Microsoft 365 or Google Workspace, VPN, remote desktop, accounting software, payroll, and your bank.
2. Check that MFA is enforced for each one, not just available. In Microsoft 365, an admin can see who has registered a method and whether sign-in policies actually require it.
3. Look hard at admin and shared accounts. These are the ones most often left out.
4. Note any exceptions, such as a scanner account that sends email, and how they are restricted.

If a question asks about "all users" and you have three exceptions, say so. A yes that turns out to be wrong is worse than an honest partial answer.

Endpoint protection and EDR

Many forms ask whether you use endpoint detection and response (EDR) rather than basic antivirus. EDR watches behavior on each computer, records what happened, and lets someone isolate a machine or stop a process. Some questions go further and ask whether the alerts are monitored around the clock, by your staff or by a provider.

To answer accurately, find out which product is installed, whether it is on every laptop, desktop and server, and who reads the alerts. A product that is installed but never watched does not match a question about monitored detection and response.

Backups

Backup questions usually ask how often you back up, whether copies are kept separate from your main network, whether they are encrypted, and whether you have tested a restore. Attackers often try to delete or encrypt backups before they encrypt everything else, which is why insurers ask about offline or immutable copies.

1. Write down what is backed up: file servers, Microsoft 365 or Google data, line-of-business databases, and laptops.
2. Confirm at least one copy cannot be changed or deleted from a normal admin login.
3. Run a test restore and record the date and result.

Our post on immutable backups explains why that separation matters.

Training, patching and the rest

Other common questions cover:

• Security awareness training: whether staff get regular training and phishing tests, and whether you keep records.
• Patching: how quickly you apply security updates, and whether any systems run software that no longer gets updates.
• Email security: filtering, and whether SPF, DKIM and DMARC are set up for your domain.
• Payment controls: whether wire transfers or bank detail changes are verified by phone using a known number.
• Incident response plan: whether you have one written down and know who to call.

How to fill in the form without guessing

1. Get the questionnaire early, not the week the policy expires.
2. Go through it with whoever manages your IT, question by question, and mark each answer yes, no or partial.
3. Keep simple evidence for each yes: a screenshot of MFA settings, a backup report, a training completion list.
4. Where the honest answer is no, ask what it would take to fix it and whether the fix can be done before renewal.
5. Ask your broker how to describe partial answers and whether any wording needs clarifying.

Treat the form as a free checklist. The controls insurers ask about are the same ones that make an attack less likely to succeed and easier to recover from.

Getting help

If you want a second pair of eyes before you answer, our IT audits and assessments check what is actually in place and give you a plain list of gaps. We can then help close them through our cybersecurity services. Creative IT USA works with businesses across Los Angeles County, the Inland Empire and Ventura County. Coverage questions belong with your broker.