Your Cyber Insurance Questionnaire Asks for Things You May Not Have

Carriers stopped asking whether you have security. They now ask what you can produce.

The questions have a shape. Every one of them is really asking: is there a written record of this, and could you hand it to someone?

Multi-factor authentication. Not “do you use MFA.” Current forms break it out by surface — remote email, remote network access, administrator and privileged accounts. Several forms offer a checkbox for administrator accounts “where allowed,” which is where most small firms quietly land. An underwriter reads that box as a gap.

Endpoint detection and response. Listed separately from antivirus, because carriers no longer treat them as the same thing. Some forms require you to name the product.

Backups, described by characteristic. Offline or air-gapped. Encrypted. MFA-protected. Tested. Recoverable inside a defined window. “We have backups” is not an answer to this question.

A written incident response plan. Tested and in effect, with named responsibilities. Not a plan you intend to write.

Payment and transfer controls. Dual verification above a dollar threshold, and confirmation through a second channel — a phone call, not a reply to the email.

Patching, training, and vendor oversight. How fast critical updates go on. Whether security training is mandatory. Whether your vendors are held to your standard in writing.

The signature block on a cyber application is not a formality. It states that the answers are true, that no material facts have been omitted, and that the insurer is relying on them in issuing the policy. The application becomes part of the contract.

One carrier’s form puts the consequence plainly: if the application contains misrepresentations or fails to state facts materially affecting the risk, the policy may be deemed null and void. Another carries a notice written specifically for Texas applicants, warning that an intentional misstatement material to the risk can be found by a court to be insurance fraud.

Read that in order. You answer yes to a control you believe you have. Two years later you have a breach — the one event where the policy is the entire point. The carrier’s forensics team examines what was actually in place. If it does not match the form, the conversation stops being about your claim and starts being about your application.

Nobody sets out to misrepresent anything. They tick a box that sounds close enough, because the alternative is admitting they do not know. That is the risk this page exists to name.

An answer you can defend has three parts: the control is in place, it is written down, and you could produce the evidence if asked.

Most firms have some of the first, little of the second, and none of the third. That is not negligence. Nobody told them the standard had moved.

Here is the part worth understanding. The questionnaire is not a separate standard your carrier invented. Nearly everything on it — a written security program, an incident response plan, vendor oversight, staff training, access control — is already required of your firm by something else. The FTC Safeguards Rule. IRS Publication 4557. SEC Regulation S-P. The Texas rules that reach your practice.

And the form is the smallest of those demands. An underwriter asks about the controls that drive claims. Your regulator asks about everything that reaches your firm, and does not stop at the edge of the form.

So the questionnaire is a useful alarm and a poor checklist. If you build only what the carrier asked, you will pass underwriting and still be exposed everywhere the form never looked. Build to what actually applies to your firm, and the questionnaire answers itself along the way. See the eleven obligations that reach Texas legal and financial firms.

You will not close every gap before the deadline, and you should not pretend otherwise on the form.

What you can do:

Answer accurately, including “no.” An honest no is underwritable. Carriers price risk; they do not expect perfection.

Where a control is partial, say so and describe what compensates for it. A documented exception with a compensating control reads very differently from a bare no — and completely differently from a yes you cannot support.

Gather what evidence you do have. Screenshots of MFA settings, your endpoint console, a backup restore test with a date on it.

Then fix what the form exposed, on a real timeline, so next year’s renewal is a different conversation.

We start with a Compliance Readiness Review. We gather what your firm actually has, then review it against what the questionnaire, your regulator, and Texas law each require you to be able to produce.

You get a written report: what you can answer truthfully today, where the gaps are, and what closing each one takes.

From there, we create the plan. If you have IT — internal or outside — we guide them through the changes and they do the hands-on work. If you have no IT, we do it ourselves, inside a scoped remediation phase with a defined end.

Then we build the documentation, so the next questionnaire is a matter of retrieving what exists rather than guessing.