What your cyber insurer will ask at renewal, and how to be ready

A few years ago a cyber insurance renewal was a form. It is now closer to an audit, and a wrong answer can void a claim. The questions are predictable, which means the evidence can be prepared before the questionnaire arrives.

Multi-factor authentication, everywhere

Insurers ask whether multi-factor authentication covers email, remote access and administrator accounts. "Mostly" is not an answer they accept. Ask your provider for the list of accounts without it, and a date by which the list will be empty.

Backups that have been restored, not merely taken

The question is no longer "do you back up" but "when did you last restore, and did it work". Keep a record of test restores with dates. If your provider cannot produce one, that is the first thing to fix.

Detection on every device

Endpoint detection and response, monitored around the clock, is now a standard requirement. The evidence is a report showing which devices are covered and which are not.

Privileged access

Who has administrator rights, and why? Insurers expect the number to be small, reviewed regularly, and separate from everyday accounts. A list of privileged accounts, with the business reason beside each, answers the question before it is asked.

An incident response plan that names people

A plan is a document that says who is called, in what order, and who speaks for the company. It should exist before the incident, and the people named in it should know they are named.

Evidence, assembled once

Each of these controls produces evidence. Kept in one place and refreshed quarterly, that evidence answers the insurer, the auditor and the client questionnaire alike. The work is the same; only the recipient changes.

A practical step: ask your provider for last quarter's evidence on the five points above. If it takes more than a week to assemble, it does not yet exist.