Cyber insurance applications, explained in plain English

A few years ago, applying for cyber insurance meant a one-page form and a signature. Today, many small businesses get a detailed questionnaire full of terms like “MFA,” “EDR,” and “immutable backups.” If you don’t have an IT department, it can feel like a test written in another language.

Every insurance company’s form is different, but most ask about the same handful of things. Here’s what they mean.

The questions you’ll likely see

“Do you require multi-factor authentication (MFA)?” MFA means signing in takes a second step beyond the password, usually a code or approval on your phone. Insurers typically ask about it for email, remote access (like VPN or remote desktop), and administrator accounts. It’s often the most important question on the form. See turn on two-step sign-in.

“Do you use endpoint detection and response (EDR)?” EDR is security software on each computer that watches for suspicious behavior and can isolate an infected machine, a step beyond traditional antivirus. Ask your IT provider exactly what’s installed on your computers and whether it’s EDR.

“Are your backups offline, immutable, or tested?” Insurers want to know that ransomware couldn’t destroy your backups, and that you’ve actually restored from them. See backups for a small office.

“How quickly do you apply security updates?” This means patching: how soon Windows, software, and equipment get updates after they come out. A written schedule, even a simple one, helps you answer this.

“Do you filter email and train employees?” Most attacks start with an email. Insurers ask whether a filter screens incoming mail and whether staff are trained to spot scams. See how to tell if an email is a scam.

“Do you have an incident response plan?” A written plan for what happens if you’re hacked: who to call and what to do first. Our free one-page incident response plan is a solid starting point.

Answer honestly, even when the answer is no

This is the most important part. Answering “yes” to a control you don’t really have is risky: if you file a claim and the insurer finds the safeguard was missing, they may reduce or deny the payout, exactly when you need it most.

“Partly” usually means “no.” If MFA is on for most people but not the front desk, or backups exist but have never been tested, say so, and ask whether you can explain it in a note.

Use the form as a to-do list

The good news: nearly every control insurers ask about genuinely lowers your risk. If you can’t honestly answer yes to something, that’s a clear sign of what to fix first, and fixing it may improve your premium at renewal.

A practical approach:

1. Get the questionnaire early, well before your renewal date.
2. Go through it with whoever handles your IT, and mark each answer yes, no, or partial.
3. Fix the easy gaps first, usually MFA and backup testing.
4. Keep proof (screenshots, reports, training records), in case the insurer asks.

Sources

• Cyber insurance requirements for small businesses (Mainsail Data): the common controls on applications, and why misrepresentation can void coverage
• Cyber insurance renewal questions every small business should prepare for (Network Computer Pros): the typical categories of renewal questions