Cyber insurance: what underwriters ask before they quote

A cyber insurance application looks like a form and functions as a set of representations. In our view that is the difficulty with it: the questions are binary, the controls behind them are usually partial, and the finished document is read by someone whose job is to price the chance that the answers are wrong.

The honest answer to a question about whether a control is enforced everywhere is often "mostly". There is rarely a box for mostly, and the work of a good submission is deciding what to write instead.

Why the form exists at all

An underwriter is not auditing you. They are deciding whether to take the risk, at what limit, at what retention and at what price — and the only information they have is what you tell them plus whatever the market already knows about companies that look like yours.

Treasury's Federal Insurance Office described the mechanism plainly when it asked for public comment in 2022 on whether a federal insurance response to catastrophic cyber incidents is warranted: "Through underwriting and pricing, insurers can encourage or even require policyholders to implement strong cybersecurity standards and controls." The same notice put the market at "approximately $4 billion in direct premiums written in 2020."

Read that as an instruction. The application is the lever, and the questions on it are the controls the market has decided correlate with losses it has already paid.

The controls the questions keep circling

Forms differ by carrier and by year, and a broker who knows your sector is worth more than any checklist. But the underlying practices are stable enough to prepare against, and they line up closely with the practices CISA gathers in its Cross-Sector Cybersecurity Performance Goals: asset inventory, vulnerability management, multi-factor authentication, least privilege, backups, logging and detection, an incident response plan, and security training. CISA gives the outcome of goal 1.E, Mitigating Known Vulnerabilities, as "Reduce the likelihood of threat actors exploiting known vulnerabilities to breach organizational networks," and the outcome of goal 2.T, Log Collection, as "Achieve better visibility to detect and effectively respond to cyberattacks."

Those are the same sentences an underwriter is reasoning with, in different words. What each question is actually asking:

• Multi-factor authentication — on which surfaces, enforced by policy rather than available as an option.
• Privileged access — who holds administrator rights, and when that list was last reviewed and reduced.
• Backups — whether a copy exists that an intruder inside your network cannot reach or encrypt, and whether you have restored from it.
• Endpoint detection and response — what proportion of endpoints and servers are actually covered, including the ones nobody wants to touch.
• Patching — the cadence for critical vulnerabilities, and whether you can show it happened.
• Email security — filtering, external-sender warnings, and the out-of-band verification step before anyone changes payment details.
• Training and phishing simulation — completion records, not the existence of a platform.
• Incident response — a written plan, with a date it was last exercised.
• Dependency concentration — which single vendor or platform outage takes your revenue offline.

The MFA question is narrower than it looks

"Do you have MFA" is several questions wearing one coat. NIST's glossary defines multi-factor authentication as "Authentication using two or more different factors to achieve authentication," where factors include "something you know (e.g., PIN, password), something you have (e.g., cryptographic identification device, token), or something you are (e.g., biometric)." The FTC's Safeguards Rule uses the same three categories, requiring verification of at least two of them, and the FTC's guidance on that rule tells covered financial institutions to "Implement multi-factor authentication for anyone accessing customer information on your system."

Two passwords are not two factors. Neither is a password plus a security question.

In our view, answer the surfaces separately even when the form does not: remote access and VPN, email, administrative and cloud console access, the backup system, and any legacy application that authenticates locally. That last category is where most partial answers live, and an underwriter who hears it named will trust the rest of the form more, not less.

The backup question is a restore question

Nobody who has run a recovery believes that "we back up nightly" is an answer. The questions that decide a ransomware claim are whether a copy is offline or otherwise out of reach of an attacker who already holds domain credentials, how long a full restore takes, and when you last proved it by doing one.

Our view, plainly: a documented restore test is the single highest-value artefact you can produce before a renewal, because it answers a control question and a business-interruption question in the same paragraph.

Put the evidence in one folder before you answer

The form takes an afternoon. The evidence behind it takes longer, and it is the evidence that survives the call with the underwriter.

What to have to hand: the inventory of systems and data — the FTC's Safeguards guidance frames this as "Know what you have and where you have it" and asks for "a periodic inventory of data, noting where it's collected, stored, or transmitted"; the last privileged access review, run as a population with a named reviewer rather than a memory, which is the ground covered in the access review an auditor will accept; the most recent assessment or penetration test report and the retest; endpoint coverage figures; patching records; training completion records; and the incident response plan.

If the submission asks for a penetration test and what you have is a control assessment, the two are not interchangeable — cybersecurity assessment vs penetration test sets out which answers which question. The FTC's guidance on the Safeguards Rule keeps them separate too, naming "annual penetration testing" alongside vulnerability assessments described as "system-wide scans every six months designed to test for publicly-known security vulnerabilities."

Answer as though it will be read after a claim

It will be. The application goes into the file, and the file is opened again when something has gone wrong.

That is not a reason to be defensive; it is a reason to be exact. Where a control is partial, say where it is partial and what the plan is. Where a question uses a term loosely, define the term in your answer. Where the honest answer is no, an underwriter can price it — what they cannot price is a yes that turns out to have had an exception in it.

Expect conditions in return. An insurer may quote subject to a control being in place by a date, and that condition is a commitment with the same weight as the answers. How your policy treats inaccurate statements is a matter for your broker and counsel.

Extortion, sanctions and who decides

Underwriters ask about ransom decision-making because the payment itself is regulated territory. Treasury's Office of Foreign Assets Control has published an updated advisory on the sanctions risks of facilitating ransomware payments, directed at the financial services industry — insurance companies included, alongside their clients — and it describes steps that would count as mitigating factors in an enforcement response, among them prompt reporting to law enforcement and the adoption of basic cyber hygiene practices and CISA's recommended measures.

The practical consequence is a question on your side of the table: who inside your company is allowed to authorise a payment, and who would be called first. If your plan does not say, the incident response plan a mid-market company can run covers how to settle that before it is urgent.

What the policy buys is a separate question

Controls decide whether you get quoted. Coverage decides whether the quote is worth taking, and the two conversations get blurred constantly.

The FTC's own guidance draws the basic line: "First-party cyber coverage protects your data, including employee and customer information," while "Third-party cyber coverage generally protects you from liability if a third party brings claims against you." It also suggests checking whether the policy covers breaches caused by a vendor, whether it applies worldwide, and whether the insurer offers "duty to defend" wording and a breach hotline.

One overlap is worth catching early. The same guidance lists "Legal counsel to determine your notification and regulatory obligations" and "Forensic services to investigate the breach" among the costs first-party coverage pays — which raises a question the form will not ask. Who picks those firms? If the policy names them and your incident response plan names your own, the two documents disagree, and the disagreement surfaces at the worst possible hour. Ask your broker.

What to do first

1. Get the current application form from your broker now, not a week before renewal, and answer it in pencil against evidence rather than memory.
2. Run one restore test and write it up, with the date, the system, the time taken and who witnessed it.
3. Reconcile the policy's response requirements with your own plan — notification timing, which vendors the policy expects you to use, and who authorises what.

If the form in front of you reads like a security questionnaire, the security questionnaire panic checker will sort the questions that need a document from the ones that need a control to exist. For an ordered view of which gaps are worth closing first, use the readiness scorecard.

This is general information, not audit, security, insurance or legal advice. Confirm what applies to you with your broker, auditor or counsel.

Common questions

Do cyber insurers require multi-factor authentication?

Requirements are set by each insurer rather than by a rule, so the honest answer is that it depends on the carrier and the submission. What is consistent is that the question is asked, and asked surface by surface: remote access, email, administrative accounts and backup consoles are treated separately, because that is where claims come from.

Why does it matter how precisely we answer the application?

Because the answers go into the underwriting file and are read again if a claim is ever made. In our view the safe practice is to answer control by control, name the exceptions rather than round them away, and keep a copy of the submission alongside the evidence that supported each answer. How your policy treats inaccurate answers is a question for your broker and counsel.

What evidence should we have ready before the underwriting call?

A current asset and system inventory, screenshots or reports showing where multi-factor authentication is enforced, the last privileged access review, evidence of a completed restore test, endpoint coverage figures, patching records, security training completion records, and the written incident response plan with the date it was last exercised.

Does a SOC 2 report answer the insurer's questions?

Partly, and it is worth sending. The access, change management and monitoring evidence behind a SOC 2 report is much of what an underwriter wants, but the report describes a scoped system over a past period and the application asks what is true today across the whole company. Expect to answer the form as well as forward the report.

What is the difference between first-party and third-party cyber coverage?

The FTC's guidance describes first-party cyber coverage as protecting your own data, including employee and customer information, and third-party coverage as generally protecting you from liability if a third party brings claims against you. Which you need, or whether you need both, is a conversation for your broker.

Will a policy simply pay a ransom demand?

Do not assume it. Extortion cover varies, and Treasury's Office of Foreign Assets Control has published an advisory on the sanctions risks of facilitating ransomware payments that is addressed to the financial services industry, insurers included. Underwriters therefore ask who inside your company would authorise a payment and whether law enforcement would be contacted.

Sources

1. Cyber Insurance — Cybersecurity for Small Business · Federal Trade Commission
2. FTC Safeguards Rule: What Your Business Needs to Know · Federal Trade Commission
3. Standards for Safeguarding Customer Information; Final Rule, 86 FR 70272 (9 December 2021) — see the definitions at 16 CFR 314.2 · Federal Trade Commission, via the U.S. Government Publishing Office
4. Potential Federal Insurance Response to Catastrophic Cyber Incidents; Request for Comment, 87 FR 59161 (29 September 2022) · Federal Insurance Office, U.S. Department of the Treasury, via the U.S. Government Publishing Office
5. Cross-Sector Cybersecurity Performance Goals (CPGs) · Cybersecurity and Infrastructure Security Agency
6. Computer Security Resource Center Glossary — 'multi-factor authentication' (definitions drawn from NIST SP 800-63-4, NIST SP 800-171r3, NIST SP 800-53 Rev. 5 and CNSSI 4009-2022) · National Institute of Standards and Technology
7. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments · Office of Foreign Assets Control, U.S. Department of the Treasury