Cyber insurance: what insurers check before they cover you

Cyber insurance helps pay for the costs of a security incident: investigating what happened, restoring systems, notifying affected people, and dealing with claims from others. Over the past few years, insurers have become much more specific about the security they expect before they'll offer cover. The application is now, in effect, a security checklist.

This guide explains what insurers commonly ask and why. It doesn't cover premiums or recommend specific insurers. Talk to a licensed broker for that, ideally one who places cyber policies regularly.

What cyber insurance usually covers

Policies vary a lot, but cover generally falls into two groups:

First-party cover (your own losses), which may include:

Incident response and forensic investigation
Legal advice (often called a breach coach)
Notifying affected customers and providing credit monitoring
Restoring data and systems
Business interruption (lost income while systems are down)
Extortion and ransomware-related costs, subject to the policy terms and the law
Funds transfer fraud or social engineering fraud, often with a lower limit

Third-party cover (claims against you), which may include:

Claims from customers or partners whose data was exposed
Regulatory investigations and, where insurable, fines
Liability for passing malware to others

Some general business or professional liability policies include limited cyber cover. Check whether yours does, and whether it's enough. Never assume.

What insurers check

Applications differ, but these questions come up again and again. They line up closely with what CISA and the FTC recommend for small businesses, so meeting them also makes you genuinely safer.

Troubleshooter

Would you pass the common questions?

Is two-factor required on email, remote access and admin accounts?

Multi-factor authentication

Expect questions about whether two-factor authentication is required for:

Email, including access from phones and web browsers
Remote access to your network or systems
Admin and privileged accounts
Cloud services holding sensitive data

This is often the single most important question. See two-factor authentication, explained and single sign-on.

Backups

Do you back up critical data regularly?
Is at least one copy separate from your main network (offline, immutable, or in a separate cloud account) so ransomware can't encrypt it?
Are backups encrypted?
Have you tested a restore recently?

See why backups are your safety net.

Updates and endpoint protection

How quickly do you install critical security updates?
Do you run endpoint protection, and in some cases endpoint detection and response (EDR), on laptops and servers?
Do you still run any unsupported software?

Managing company laptops and phones covers how to enforce updates across a team.

Email security

Do you filter incoming email for phishing and malware?
Have you set up SPF, DKIM, and DMARC for your domain? See SPF, DKIM & DMARC for email senders.

People and process

Do staff complete security awareness training, including phishing?
Do you verify requests to change bank details or send payments, using a separate channel such as a phone call to a known number?
Do you have a written incident response plan?
Do you remove access promptly when people leave?

Data you hold

What types of sensitive data do you store (payment cards, health information, ID numbers)?
Roughly how many records?
Do you encrypt sensitive data?

Answer the application accurately

Your answers matter later

The application is usually part of the basis on which the policy is issued. If an answer turns out to be inaccurate, for example you said two-factor was required on all email but it wasn't, the insurer may dispute a claim. If a control is partly in place, say so and explain. If you're unsure what a question means, ask your broker before answering.

Good practice:

Have the person who actually manages your systems (your IT provider, or whoever owns your security plan) review the technical answers
Keep a copy of the completed application
Tell your broker if something changes significantly during the policy period, if the policy requires it

Read the policy, not just the summary

Things worth checking with your broker:

Notification requirements. How quickly must you report an incident, and to whom?
Panel vendors. Must you use the insurer's chosen forensic firms and lawyers? Usually yes. Calling your own first may not be covered.
Social engineering and funds transfer fraud. Is it covered? What's the limit? Are there conditions, such as call-back verification?
Exclusions. For example, failures to maintain the security controls you stated, certain state-backed attacks, or infrastructure outages.
Waiting periods for business interruption cover.
Retention (deductible) amounts.

Preparing for a renewal or new application

Pull together your evidence. Screenshots of two-factor enforcement, your backup reports, your security policy, and your incident contact sheet.

Close the gaps you can. Two-factor on email and admin accounts, and separate backups, are usually the quickest high-value fixes.

Write down what's in progress. If a control is being rolled out, say what and when.

Review with your broker before submitting.

Frequently asked questions

Will insurance pay a ransom?

Some policies include extortion cover, subject to conditions, the insurer's approval, and the law, which can prohibit payments to sanctioned groups. The FBI and CISA discourage paying ransoms. Treat insurance as help with recovery, not a plan to pay.

Is cyber insurance a substitute for security?

No. Insurance helps with the financial impact. It doesn't restore customer trust, prevent downtime, or cover everything. And insurers increasingly won't offer cover without basic controls in place.

Our clients require us to carry cyber insurance. What should we check?

Check the required limit, whether the client must be named on the policy, and whether the cover type matches the contract (for example, technology errors and omissions alongside cyber). Share the contract wording with your broker.