Why the questionnaire got longer
Insurers pay claims for ransomware, business email compromise and data breaches, and they have learned which security practices correlate with fewer and smaller losses. As a result, many carriers and brokers now ask pointed technical questions before they quote or renew a policy. Some applicants are declined, offered narrower terms or asked to fix specific gaps first. The details vary by insurer and change over time, so treat this page as a general guide and rely on your broker for what your carrier wants.
The controls insurers commonly ask about
While every application is different, these topics come up again and again:
- Multi-factor authentication (MFA). Typically on email, remote access such as VPN, and administrator or privileged accounts. Sometimes also for backups and cloud management consoles.
- Endpoint detection and response (EDR). Behavior-based protection on laptops, desktops and servers, rather than traditional antivirus alone.
- Backups. Whether they are separated from the main network, protected from deletion, and tested by restoring real data.
- Logging and monitoring. Whether security events are collected, retained and watched by someone, including outside business hours.
- Email security. Filtering for phishing and malicious attachments, and controls against spoofing.
- Patching and unsupported systems. How quickly critical updates are applied, and whether end-of-life software is still in use.
- Privileged access. Who has administrator rights, and whether those accounts are separate and protected.
- Incident response plan. Whether a written plan exists, who is on it and whether it has been rehearsed.
- Employee training and phishing simulations, and how you manage vendors who touch your data.
How we approach readiness
We work in four steps that mirror how a questionnaire is answered:
- Collect the questions. Bring us the current or prior application, or the broker's list of requirements, and we translate each question into plain English.
- Find the real answers. We check how each control is actually configured in your environment rather than how people remember it.
- Close the gaps. We prioritize fixes by impact and effort, such as turning on MFA, deploying endpoint protection, fixing backups and writing the incident response plan, and then work with your IT team to complete them.
- Keep the evidence. Screenshots, configuration exports, policies and training records are organized so next year's renewal takes hours rather than weeks.
Accuracy matters more than a perfect score
It can be tempting to answer "yes" to everything. Resist that. A statement on an application that turns out to be inaccurate may become a problem at claim time, so it is worth confirming each answer against what is truly in place and discussing uncertain ones with your broker. A truthful "not yet, and here is our plan" can serve you better than an overstated yes. The person who signs the application is responsible for it, and we do not sign it for you. What we do is give you reliable facts to sign with.
Controls that help beyond the application
The same measures that satisfy an underwriter also make a real incident less likely and less damaging. Pair this work with ransomware protection to harden the specific threat that drives most claims, and consider phishing training to reduce the human side of the risk. If your business is in a regulated field, our HIPAA security help shares many of the same safeguards. For organizations that want someone to own the entire program, a fractional vCISO can run it year-round.
We work with businesses across the Dallas-Fort Worth area, remotely by default and on-site when useful. Start with a free assessment and bring your latest questionnaire if you have one.