Cyber Insurance Renewal: How to Answer the Security Questions
The renewal email arrives with a form attached. It is full of security questions: Do you use sign-in codes (multi-factor authentication, or MFA)? Are your backups kept offline? Are they tested? Is every computer protected? Do you train your staff?
You run a business, not an IT department. It’s easy to tick “yes,” hope it is close enough, and sign.
Here is the problem. The insurer prices and issues the policy based on those answers, so an answer that turns out to be untrue can come back to hurt you when you file a claim. This guide walks through what the security questions can cover, why an honest answer matters, and how to gather proof before your cyber insurance renewal.
What Do Cyber Insurance Applications Ask?
Cyber insurance applications ask detailed questions. Two published examples show the kind of thing to expect:
- Corvus (application version 3.2, September 2024) asks whether backups are kept offline, can’t be changed, and need a sign-in code to reach.
- Travelers (2019 edition) asks whether backup and recovery procedures are tested every year, and whether sign-in codes protect email and remote access.
Your insurer’s current form may differ, so always work from the form you were actually sent.
You will see MFA again and again. It is the extra step after your password, like a code on your phone or a prompt in an app. On this site we say sign-in codes, and the Corvus and Travelers applications ask about them in several places.
Forms also ask about things like protection on every computer and staff training. Our cyber insurance renewal help checks those, plus software updates and email security, one question at a time.
Why Does an Honest Answer Matter?
Because the answers become part of what the insurer relies on. One court record shows what can happen.
In 2022, after a ransomware attack, Travelers sued a small company to cancel its cyber policy. Travelers said the company had answered “yes” to using sign-in codes for administrator access (the accounts that can change your systems), but only used them on its firewall. The court sided with Travelers in August 2022, canceling the policy and dismissing the case.
We found no written decision on the facts, so this doesn’t mean every wrong answer cancels a policy. It does show the risk of a “yes” you can’t back up. If sign-in codes are on some accounts and not others, write that down and ask your broker how to answer.
This isn’t legal or insurance advice. Your broker and your insurer are the right people to ask about your policy.
How to Check Each Answer Before You Sign
Take the form one question at a time and ask two things:
- What is really in place today? Not what was planned, and not what the IT company set up years ago, which may have changed since.
- Can you prove it? If the insurer asked tomorrow, could you show them?
Proof can be simple. It might be a dated screenshot of a setting, a settings report from your email system, a record of a restore test, or a list of who finished security training and when. Keep it organized by the questions on the form, so you can find each piece quickly.
If you have an IT company, ask them to walk through the questions with you. They know what they set up; you know what the form asks.
When you can’t answer a question honestly, don’t guess. Talk to your broker before you sign. The answers on the form are yours to give and sign, and your broker can help with the form itself.
MFA and Backups: Two Questions to Look at Closely
Both example applications ask about these two, so they are worth extra attention.
Sign-in codes (MFA). Check email first, including the owner’s account and any shared mailboxes. Then remote access, meaning any way someone can get into your office systems from outside. Then the accounts that can change your systems. Old remote access that nobody uses anymore is worth closing, too.
Backups. Find out whether your backups are kept offline or locked so they can’t be changed, whether reaching them needs a sign-in code, and when a restore was last tested. A dated restore test is one kind of proof for the backup questions. Our backup service includes regular restore tests and a dated report, which become part of the dated proof you gather for your renewal.
Cyber Insurance Renewal Checklist for This Week
Start this week, well before your renewal date:
- Find last year’s application and note when this year’s renewal is due.
- Highlight every security question on the form.
- For each “yes,” write down who set it up and where the proof is.
- Check that sign-in codes are on for every email account, remote access and the accounts that can change your systems.
- Ask when a backup restore was last tested, and get the result in writing.
- Find your staff training records, with dates.
- List every question you can’t answer yet, and send that list to your IT company or broker.
Get a Free Insurance Proof Call
Want a second opinion on your answers? Ask for a free insurance proof call. On a short call we go through the security questions on your last application or this year’s renewal and, based on what you tell us, point out the proof to gather and the settings to check. It costs nothing, and there is nothing to buy. Keep your policy, your application and any passwords out of the message.
We don’t sell insurance, and we can’t promise approval, a lower premium or that a claim will be paid. That is between you, your broker and your insurer. To see how we check answers, fix the gaps you agree to and keep dated proof, read about cyber insurance answers you can prove. Something else on your list? Pick a free check.