How to read your cyber-insurance questionnaire

A cyber-insurance renewal used to be a formality — a page or two, a signature, a slightly higher invoice. That era is over. Today's application runs ten to twenty pages of pointed technical questions, and the carrier's underwriting team reads your answers the way an auditor reads a control matrix. Every "yes" is a claim you may have to defend after an incident. Every "no" is a lever they can pull to raise your rate, cut your limits, or walk away entirely.

Here's the reframe that changes how you fill it out: the questionnaire is not asking whether you have insurance-worthy security. It's telling you, question by question, what "insurable" now means. Read it that way and it becomes the cheapest security assessment you'll ever receive.

What the questions are really testing

The wording varies by carrier, but the substance has converged. Nearly every modern application probes the same eight control areas. Knowing what each one is checking for lets you answer honestly instead of optimistically.

• Multi-factor authentication, everywhere. Not just VPN or webmail — email, remote access, admin consoles, and cloud apps. Carriers ask separately about each because "we have MFA" almost never means all of them.
• Endpoint detection and response (EDR). They want to know you run behavioral endpoint protection, not just legacy antivirus, and that someone is actually watching it.
• Tested, offline backups. The key word is tested. "We back up nightly" fails the question if you've never performed a restore and the backups aren't isolated from the network ransomware would reach.
• Email filtering and phishing defense. Advanced filtering, impersonation protection, and link/attachment analysis — because most claims still start with an inbox.
• Security awareness training. Regular, documented, with simulated phishing. "We send occasional reminders" is a no.
• Privileged access management. Are admin accounts separated from daily-use accounts? Is access reviewed? Are local admin rights removed from ordinary users?
• A written incident response plan. Documented, assigned, and — increasingly — tested with a tabletop exercise in the last twelve months.
• Patch and vulnerability management. A defined cadence for critical patches, not "when we get to it."

Why a weak answer costs real money

Underwriters price risk. A stack of confident, verifiable "yes" answers signals a defensible organization and earns better terms. A pattern of "partially," "planned," or "no" does one of three things, and none of them are good.

It raises your premium

Missing controls translate directly into higher expected loss, and the math shows up on your invoice. The gap between a fully-controlled applicant and a half-controlled one can be a multiple, not a few percent.

It shrinks your coverage

Carriers increasingly attach sublimits and coinsurance to specific weaknesses — a reduced ransomware limit if backups aren't isolated, for example. You keep the policy but quietly lose the protection you thought you bought.

It can void the claim entirely

This is the one that ends businesses. If you attested to MFA on all remote access and an investigation after a breach finds a gateway without it, the insurer can deny the claim on the grounds of a material misrepresentation. The policy was never really in force for that risk. Answering "yes" to something you can't prove isn't optimism — it's an uninsured position wearing a policy number.

Map each gap to a fix

The productive way to work the questionnaire is to treat every honest "no" as a line item on a remediation plan. Most of these have direct, well-understood fixes.

• No MFA everywhere → deploy a zero-trust multi-factor authentication (MFA) & device trust platform across email, VPN, and admin access.
• Legacy AV only → replace with managed EDR watched by a SOC.
• Untested backups → move to immutable, offsite backups and schedule quarterly restore tests.
• Weak email defense → layer advanced filtering and impersonation protection on top of the mailbox provider.
• No training program → stand up recurring awareness training with simulated phishing.
• Shared admin rights → separate privileged accounts and strip local admin from standard users.
• No IR plan → adopt a one-page runbook and run a tabletop before the next renewal.
• Ad-hoc patching → define a patch cadence with SLA and reporting.

How an MSSP helps you answer "yes" — truthfully

The value of a managed security partner on renewal day isn't filling in the form for you. It's making the honest answers the confident ones. When your EDR, email defense, backups, identity, and monitoring run under one accountable operation, most of the questionnaire answers itself — and you have the documentation, logs, and test records to back every attestation if a claim is ever examined.

At Atom, we routinely sit with clients and their broker, walk the application line by line, and separate the genuine "yes" from the wishful one before it's signed. Where there's a gap, we close it in the order the carrier weights it, so the next renewal costs less instead of more. The goal is simple: every box you check is one you could defend under oath — because after a breach, that's exactly what an attestation becomes.

If your renewal is coming up, don't answer it from memory. Answer it from evidence.