Cyber insurance used to be a quick form. Now it comes with a security questionnaire, and your answers decide whether you get covered and what you pay. The good news: underwriters are mostly checking for the same basic controls that protect you anyway. Put these eight in place and you turn a stressful application into a straightforward one.

1. Multi-factor authentication

This is the first question on almost every application, and increasingly a hard requirement. Insurers want MFA on email, remote access, and administrator accounts. If you do one thing before applying, do this.

2. Tested, offline backups

Underwriters ask whether you back up your data, keep a copy offline or immutable, and test restores. This is also exactly what saves you in a ransomware event, so it earns its place twice.

3. Endpoint detection and response

Modern protection on laptops and servers, often called EDR, shows insurers you can detect and contain an attack rather than just hope to avoid one.

4. Email security and filtering

Since most attacks arrive by email, expect questions about spam filtering, link protection, and whether you flag mail from outside your organization.

5. Security awareness training

Insurers want to see that your team is trained to recognize phishing and that you run periodic refreshers. A documented program counts for more than an informal “we tell people to be careful.”

6. A patch and update process

Being able to say you apply security updates promptly, ideally automatically, signals that you close known holes quickly.

7. An incident response plan

Even a one-page plan that names who to call and what to do counts. It tells the insurer you will respond in an organized way, which lowers their expected cost and yours.

8. Access control and offboarding

Expect questions about limiting administrator rights and removing access when people leave. A simple inventory of accounts and an offboarding checklist cover this.

---

Answer these honestly and accurately. Claiming a control you do not have can void a claim later. If you are not sure how your business measures up against this list, a free assessment maps your gaps to exactly these categories so you know what to fix before you apply.