Answering a cyber insurance questionnaire honestly

A cyber insurance proposal form looks like a tick-box exercise. It is a set of statements about your business that the insurer relies on when deciding whether to cover you and on what terms. If an answer turns out to be wrong after an incident, it can cause problems with a claim. This article covers the controls these questionnaires commonly ask about, how to check your real position, and how to close gaps before renewal.

This is a plain-English summary, not legal or insurance advice. Every insurer's form is different, so read your own policy wording and check with your broker or adviser about what your answers mean.

Answer for the business you have today

The most common mistake is answering for the business you plan to have. "We're rolling out MFA next month" is a no today. A few rules help:

• Answer each question about every user, device and system unless the question says otherwise. "Most staff" is not "all staff".
• Do not guess. If you are unsure, ask your I.T. provider for evidence such as a report or a screenshot.
• If a question is ambiguous, ask your broker what it means and keep a record of the answer.
• Use the comments field to explain partial coverage or a planned fix with a date.
• Keep a copy of the completed form and the evidence behind it.

The controls insurers commonly ask about

Multifactor authentication (MFA)

Expect questions about MFA on email, remote access, cloud services and administrator accounts. The Australian Signals Directorate (ASD) advises small businesses to turn on MFA wherever possible, starting with the most important accounts, and to secure administrative accounts with MFA. Check:

• Is MFA enforced for every user, including shared mailboxes that people log in to directly?
• Are admin accounts covered, including any held by your I.T. provider?
• Are there exceptions, such as a reception PC or a director who refused?

Backups

Questions usually cover how often you back up, whether backups are kept separate or offline, and whether you test restores. ASD's backup guidance recommends an offline backup, protecting backups so ordinary accounts cannot modify or delete them, and testing the entire backup rather than a spot check. For Microsoft 365, ASD says the built-in recycle bins and retention features are not sufficient to recover from many incidents and recommends a third-party backup. Check:

• Are Microsoft 365 email and files backed up by a separate tool?
• Where are the backups stored, and could a compromised admin account delete them?
• When was the last test restore, and what was restored?

Patching

Insurers often ask how quickly you apply security updates. ASD's small business guidance for Microsoft environments says internet-facing services should be patched within two weeks of release, or within 48 hours if an exploit exists, and that office suites, browsers, email clients, PDF software and security products should be patched within one month. ASD also says software no longer supported by its vendor should be removed. Check:

• Are Windows and Mac updates managed centrally, with a report showing which devices are behind?
• Are firewalls, routers and remote access devices kept up to date?
• Is any unsupported operating system or software still in use?

Endpoint detection and response (EDR)

Many forms ask whether you use EDR, which goes further than traditional antivirus by recording device activity and supporting investigation and response. Microsoft Defender for Business, included in Microsoft 365 Business Premium, includes an EDR capability for businesses up to 300 users. Check that it is installed and reporting on every computer, including laptops that rarely come into the office.

Email security

Expect questions about filtering, phishing protection and email authentication. Microsoft Learn describes SPF, DKIM and DMARC as building blocks that work together, and says anything less than all three results in substandard protection against spoofing. Check that all three are configured for every domain you send email from, and that DMARC is set to an enforcing policy once you have reviewed its reports.

Staff training

Forms often ask whether staff receive security awareness training and how often. ASD's small business guide describes employees with good cyber security practices as the first line of defence, and recommends refreshing training periodically. Keep a record of who completed training and when.

Incident response

Some forms ask whether you have an incident response plan. ASD's small business guide recommends creating an emergency plan for cyber security incidents and keeping a hard copy in case systems are offline.

Closing gaps before renewal

Start at least two to three months before renewal. Some fixes, such as rolling out MFA to every staff member or replacing an old server, take time.

1. Get the questionnaire early. Ask your broker for this year's form as soon as possible.
2. Map each question to evidence. Ask your I.T. provider to answer each item with a report or screenshot, not a yes or no.
3. Fix the quick wins first. Enforcing MFA, turning on automatic updates and configuring DMARC can often be done in days.
4. Plan the bigger items. Separate backups, replacing unsupported systems and EDR rollout may need a project and budget.
5. Disclose honestly what is not finished. Note the planned completion date in the form and discuss it with your broker.
6. Keep evidence on file. Store reports with the completed form so you can show what was true at the time.

This is the kind of gap check we run in a free risk check with Shane at Black Wolf.

Pre-renewal checklist

• MFA enforced for all users and all admin accounts, with no undocumented exceptions.
• Microsoft 365 and server data backed up separately, protected from deletion and test restored.
• Patching managed centrally with a current report; no unsupported software.
• EDR installed and reporting on every device.
• SPF, DKIM and DMARC configured for every sending domain.
• Security awareness training completed and recorded.
• Written incident response plan, with a printed copy.
• Completed questionnaire and supporting evidence saved together.