Cyber insurance application checklist: what to gather before you fill it in
Cyber-insurance applications have grown from a page of yes/no questions into detailed security questionnaires. Wording varies by carrier and changes over time, but the same themes come up again and again. Preparing before your renewal date means fewer surprises, fewer rushed "yes" answers you can't back up, and a clearer conversation with your broker.
Important: this list is a preparation aid, not a substitute for your actual application. Answer each carrier's questions truthfully, read the definitions they use, and ask your broker if you're unsure. We're not affiliated with any insurer.
Before you start: three things to collect
- Basic facts: revenue, employee count, the industries you serve, and roughly how many personal records you hold (customers, patients, employees). Applications often use these to size risk.
- An asset list: how many laptops, servers and phones you have and what operating systems they run. An inventory makes the "all devices" questions answerable.
- Your IT provider: if someone manages your IT, many answers will come from them. Book time with them early.
The checklist
Multi-factor authentication
- MFA enforced for all users on company email (web and mobile).
- MFA on all remote access (VPN, remote desktop, remote-support tools).
- MFA on administrator accounts, including cloud admin portals.
- MFA on backup consoles and critical cloud apps.
- Legacy email protocols that bypass MFA disabled.
We cover this area in depth in Cyber insurance MFA requirements.
Endpoint protection
- Endpoint detection and response (EDR) on every workstation and server, not just antivirus.
- Someone monitoring EDR alerts, internally or through a managed provider.
- Staff don't have local administrator rights on their computers.
Backups
- Critical data backed up at least daily.
- At least one copy offline, immutable or otherwise separated from your main network.
- Backups encrypted.
- A successful restore test in the last 12 months, with a record of it.
- Microsoft 365 or Google Workspace data backed up by a separate service.
Patching and exposure
- Critical patches applied within a defined window.
- No end-of-life operating systems or software in use.
- Remote Desktop not exposed directly to the internet.
- Internet-facing systems scanned for vulnerabilities.
Email security
- Advanced email filtering for malicious links, attachments and impersonation.
- SPF, DKIM and DMARC configured for your domains.
- External-sender warning banners.
People and training
- Security awareness training at least annually.
- Phishing simulations.
- A signed acceptable use policy.
Payments and fraud
- Bank-detail changes verified by calling a known phone number, never the one in the email.
- Dual approval for payments above a threshold.
Fraud coverage questions are common for good reason: the FBI IC3 2025 Internet Crime Report recorded about $3.05 billion in business email compromise losses for 2025.
Incident response and governance
- A written incident response plan.
- The plan tested (for example, a tabletop exercise) in the last 12 months.
- Your insurer's claims hotline recorded in the plan.
- Written security policies approved by leadership.
- Prompt removal of access when staff leave; periodic access reviews.
- Laptops and phones encrypted.
- Vendors with access to your systems or data assessed.
Turn gaps into a plan
You will probably find some "no" or "partial" answers. That's normal. For each one, record an owner, a target date and where the evidence will live. Fix the high-impact items first, which are usually MFA, backups and EDR. Then talk to your broker: an honest "partial, completed by March" is far better than an inaccurate "yes."
Tools that make this faster
The Cyber-Insurance Readiness Checklist is an Excel workbook with 40 controls grouped like the list above, drop-down status, owner, target date and evidence columns, and an automatic readiness score. If you also need the written policies applications ask about, the Starter Kit pairs the checklist with five core policies, and the Complete Bundle includes all ten policies plus an IT asset inventory.