Answering a cyber insurance security questionnaire
What the MFA, EDR, backup and patching questions really ask, why honest answers matter, and how to close the gaps before your policy renews.
Applying for cyber insurance, or renewing it, now usually means filling in a security questionnaire. For a small business without its own IT department, the questions can be hard to read: "Is MFA enforced for all remote access?", "Do you have EDR on all endpoints?", "Are backups segregated from the network?". It is tempting to tick "yes" and move on. This guide explains what the common questions are really asking, why honest answers matter, and how to close the gaps before you sign.
Why the answers matter
The questionnaire is part of your application. The insurer prices the policy, and decides whether to offer one at all, on the basis of what you tell it. If you later make a claim and the insurer finds that a control you said was in place was not, it may have grounds to dispute the claim. The exact consequences depend on the policy wording and the law that applies, so read the declarations section carefully and ask your broker about anything you are unsure of. The practical rule is simple: if you are not sure an answer is true, find out before you submit it.
What the common questions mean
Multi-factor authentication (MFA)
Insurers usually ask separately about email, remote access and administrator accounts. "Enforced" means it is required for every user, not just available. Check for exceptions: the owner's account that was left out because it was inconvenient, a shared mailbox someone signs into directly, an old VPN or remote desktop connection that still accepts a password alone. Each of those makes a "yes" untrue.
Endpoint detection and response (EDR)
EDR is security software that watches each computer for suspicious behavior and lets someone investigate and isolate a machine, not just a basic antivirus scanner. Questions often ask whether it covers all endpoints, servers included, and whether someone actually monitors the alerts. If alerts go to an inbox nobody reads, say so or fix it.
Backups
Expect questions about how often you back up, whether a copy is kept offline or in a form that cannot be changed or deleted from your network, whether backups are encrypted, and whether you have tested a restore. A NAS on the same network, or files synced to the cloud, may not meet that description, because ransomware can reach both. Our article on running a test restore drill covers how to prove the last point.
Patching and unsupported software
You may be asked how quickly critical updates are installed and whether you run any software or operating systems that no longer receive security updates. Count everything, including the old PC that runs a single program and the firewall in the closet.
Email security and training
Questions here cover email filtering, whether staff receive security awareness training, and sometimes whether you check payment change requests by phone before paying. If your process is informal, write it down.
Admin accounts and remote access
Insurers want to know whether staff use everyday accounts without administrator rights, how many admin accounts exist, and how outside vendors connect. A remote access tool that a former IT provider installed years ago and nobody has removed is a common surprise.
Incident response plan
This asks whether you have a written plan for what happens when something goes wrong: who to call, how to reach the insurer's breach hotline, who can make decisions. It does not need to be long, but it needs to exist and people need to know where it is.
How to prepare
- Get the questionnaire early, ideally weeks before renewal, not days.
- Go through it with whoever runs your IT. For each question, write down the evidence: a screenshot of the MFA policy, the list of devices with EDR, the date of the last restore test.
- Mark each answer as yes, partial or no. Be honest about "partial".
- Close the quick gaps first. Enforcing MFA on the last few accounts, removing an unused remote access tool or turning on backup immutability can often be done before the deadline.
- Explain the rest. Where a control is being put in place, many applications let you add notes. Discuss with your broker how to present it.
- Keep a copy of what you submitted and the evidence behind it, so next year's renewal is faster and you can show what was true at the time.
After the policy starts
The controls you described need to stay in place for the whole policy period. Staff changes, new laptops and new software are the usual way they slip. A short quarterly check against your answers keeps them true.
Our cybersecurity services and managed backup cover many of the controls these questionnaires ask about. This article is general information, not legal or insurance advice. If you would like help working through a questionnaire before renewal, call (213) 986-4855.