How to Answer a Cyber Insurance Questionnaire for Your Firm

Clients and insurers are asking about MFA, endpoint protection, and backup testing. Most small firms have no idea what these terms mean in that context, and a wrong answer can void coverage.

A form lands in your inbox from your insurance broker. It is a cyber insurance questionnaire, and it is full of terms you do not use every day. Do you enforce MFA? Do you run EDR on all endpoints? Are your backups immutable? You read it twice and think, “I have no idea, and I do not want to guess.”

Here is why guessing is dangerous. Checking “yes” on something you do not actually have feels harmless. It is not. If you have a claim later and the insurer finds the answer was wrong, they can deny it. The wrong answer can void the coverage you paid for.

Here is the short version. Cyber insurance forms check whether your firm has a short list of security basics. Five come up the most: a second login step (MFA), real endpoint protection (EDR), protected backups, email filtering, and a written plan for a hack. You should answer honestly, with proof, not from memory. If the honest answer is no, say so and share your plan to fix it. Do not check the box and hope.

Below, we walk through each question in plain English. You will see what they are really asking and how to answer it.

Answer honestly, every time, and with proof if you can.

First, why this form matters so much

You carry insurance because you are careful. That is smart, and getting this questionnaire right protects the very coverage you are paying for. So this is worth slowing down for.

Two things have changed. Insurers used to take your word for it. Now many want evidence, like screenshots and reports. And after a claim, they can check your answers against what really happened.

In 2022, Travelers sued an Illinois electronics maker called International Control Services. ICS had said on its application that it used MFA to protect admin access. After a ransomware attack, Travelers found MFA only on the firewall, not the server. The two sides agreed to void the policy, and ICS lost its coverage for the attack.

The good news is that these controls are within reach for a small firm. Getting to a real “yes” makes the form easy to answer. It can also help you qualify and get better terms. And it makes your firm a much harder target.

Question 1: Do you enforce MFA?

In plain English, the question is: when someone logs in, do they need a second step beyond the password? A code from an app, a tap on the phone, a tap of a security key. That second step is multifactor authentication (MFA).

Insurers usually want MFA in three places: email, remote access (like a VPN or remote desktop), and admin accounts (the powerful logins that control everything). They may ask for proof, like a screenshot of the policy that forces it on.

How to answer. Only check “yes” if MFA is actually turned on and required, not just available. Read the exact words, too. If the form says “all admin accounts,” one gap makes the honest answer no. That is exactly what tripped up ICS.

If MFA is on for email but not remote access, say so. MFA is one of the fastest fixes, so start it right away. We cover the why in our post on what small firms get wrong about passwords.

Question 2: Do you run EDR on all endpoints?

This one trips up firms because it sounds like antivirus. It is not the same thing.

Plain English first. An endpoint is any computer, laptop, or server your team uses. EDR (Endpoint Detection and Response) is modern security software that watches each device for bad behavior, catches threats in real time, and can isolate a machine automatically if it gets hit. It is a big step up from the old antivirus that just scanned for known viruses.

Here is the catch. The basic antivirus built into Windows, or an old antivirus product, usually does not count. But check what you already pay for before you buy anything. Microsoft 365 Business Premium includes Defender for Business, which does have EDR. The names are confusing, so ask your IT provider which one is turned on, on every machine.

How to answer. Check “yes” only if you actually have EDR (or its managed cousin, MDR, where a team watches it for you) on every device, servers included. If you only have basic antivirus, the honest answer is no, and EDR is the fix. It can take a week or two to roll out and test across a firm.

Question 3: Are your backups immutable and tested?

Backups are where ransomware does its worst damage, so insurers dig in here.

Plain English. The question has two parts. Immutable means the backup is locked for a set time, so no one can change or delete it, not even an attacker. Tested means you have actually restored from it and proven it works. A backup you have never tested is a guess, not a safety net.

Why they ask. Attackers go after backups, because a firm that can restore has no reason to pay a ransom. Veeam, a backup software company, surveyed ransomware victims in 2023. Attackers went after the backups in 93% of those attacks. So insurers want a locked (immutable) copy, plus a copy kept off site or offline.

How to answer. Say “yes” only if your backups are protected from tampering and you have done a real test restore. If your backup is just a drive someone copies files to, that is not immutable. The honest answer is no.

Not sure which one you have? Our 10 minute backup check shows you how to find out. For the full setup, see our post on protecting your BIM files.

Question 4: Do you filter email for phishing?

Many attacks start in the inbox, so this question is about your front door.

Plain English. Email filtering scans incoming mail and blocks the dangerous stuff. That means phishing (fake emails that trick people into giving up passwords or clicking bad links), spoofed senders, and malware attachments. Insurers want to know what does this job for you, not just that you have a junk folder.

How to answer. Name what you actually use. If you are on Microsoft 365, built in protection against spam, malware, and phishing is already on by default. Business Premium adds a stronger layer called Defender for Office 365. Some forms also ask about DMARC (a setting that helps stop people from faking your email address), so check that too.

Question 5: Do you have an incident response plan?

The last big one is not software. It is a plan.

Plain English. An incident response plan is a short written document. It says what your firm does if you get hacked. Who you call first. How you cut off the problem. Who tells clients. Where the backups are, and who restores them. It does not need to be fancy, but it needs to be written down.

Many plans miss one detail. If you carry cyber insurance, call your insurer first, before your IT company. Many policies require the insurer’s approved vendors, or their OK before you hire anyone. Skip that step, and those bills may not be fully covered. We walk through the full call order in our post on ransomware.

Why they ask. In a real attack, the firms that recover fast are the ones who already decided what to do. The firms that panic and improvise lose days. A plan is the difference.

How to answer. Be honest. If you have a written plan, say yes. If your “plan” is “we would figure it out,” that is a no. Writing a short one is the fix, and even one page beats nothing.

How to answer the whole form the right way

Answer honestly, every time. An honest “no” might mean a higher price or a gap in what the policy covers. A false “yes” can cost you the whole policy, like it did for ICS. That is never a good trade.

Answer with proof. Insurers increasingly want evidence, so gather the screenshots and reports as you go. If you cannot prove it, treat it as a no until you can.

Know who signs. Usually the owner or another officer signs the form. Your IT provider can gather the facts, but the answers belong to your firm. Keep a copy of what you sent, and keep those answers true all year.

Do not let your coverage lapse while you fix things. Check your renewal date first, and talk to your broker about timing. If you have gaps, answer “no” and attach a short plan with dates. Underwriters tend to respond better to a written plan than to an unexplained gap.

For example, let’s say your renewal is three weeks out. Your form has three honest “no” answers: no MFA on remote access, basic antivirus instead of EDR, and an untested backup. Turn on MFA and run a test restore now, since those are fast. Then answer the EDR question honestly and send the rollout date with the form.

Other questions you will probably see

The five above get the most attention, but they are not the whole form. Every insurer’s list is a little different. The broker Marsh, for example, tracks twelve key controls.

Expect questions about security training and fake phishing tests. Expect questions about patching, and about old computers that no longer get updates. Many forms ask if remote desktop is open to the internet. Many also ask if admins use a separate login for admin work.

For construction firms, also think about payment changes. If a vendor emails new bank details, how does your team check it? The habit to build is a quick call to a number you already know. We cover it in our post on wire fraud in construction.

Frequently asked questions

We will help you answer it truthfully, and well

You should never have to guess on a form that protects your firm. We explain each question in plain English and tell you honestly where you stand. Then we help you close the gaps and pull the reports that prove it. The answers and the signature stay with you, because you know your firm best.

Our managed IT services help small architecture, engineering, and construction firms put these controls in place and keep the proof on file. Based in East Tennessee. Serving firms nationwide. So you are not guessing the next time a form shows up.

If a cyber insurance questionnaire is sitting in your inbox, give us a call for a free IT checkup. We will show you what you have, what is missing, and what proof exists. Then you can answer the form with real facts in hand.

Sources: Travelers v. ICS and cyber insurance applications (Lockton), Travelers asks court to rescind cyber policy over MFA (Carrier Management), Cyber insurers clamp down on self attestations (Data Center Knowledge), 12 key cybersecurity controls (Marsh), What underwriters actually check (SeedPod Cyber), 2023 Ransomware Trends Report (Veeam), Defender for Business and Business Premium (Microsoft), Built in security for cloud mailboxes (Microsoft), Cyber coverage: 13 ways to maximize it (Reed Smith)