The Cyber Insurance Questionnaire, Question by Question

Many cyber insurance questionnaires look like a quiz in a language you did not choose to learn. “Do you enforce MFA on all remote access?” Sure. Probably. Which accounts count again?

This post walks through the questions renewal forms commonly ask, one at a time. For each one you get what it means in plain English and what a well-documented control looks like. The goal is simple: when you sit down with the form, you know what each question is after and which records to pull first.

One thing up front. The questionnaire is yours. You read it, you answer it, you sign it. We do not fill in, review, or submit your form, and we are not an insurance agency or broker. Questions about coverage, limits or carriers belong with your insurance agent.

Wording and order vary from carrier to carrier, so treat this as a map, not a copy of your form. If you want the controls-first view, our post on cyber insurance requirements covers what to put in place. This one is form-first.

What does a cyber insurance questionnaire ask?

It asks how your business protects its accounts, data and devices, and what happens when something goes wrong. Renewal forms commonly ask about multi-factor authentication, backups and restore testing, endpoint protection, email security, staff training, and who has administrator access. Some also ask about a business continuity or recovery plan.

Some forms add a separate ransomware section, and some ask about the vendors you rely on. Many are yes or no with a box for detail. Those boxes matter, because “yes” means different things to different people. Write down what “yes” means in your office before you tick it.

Who answers the cyber insurance questionnaire at a small firm?

The owner or an authorized officer signs it. That is the person making the statement, so that is the person who should understand each answer.

In a firm of 10 to 50 people, the owner usually works with whoever knows the systems: an office manager, an internal tech, or an outside IT provider. They supply facts. The signer decides what goes on the page. If nobody can supply a fact, the honest move is to find it out, not to round up.

What are the multi-factor authentication questions asking?

What it means. MFA (multi-factor authentication) means a password alone does not get someone in. They also need a second proof, like a code on a phone. Forms commonly ask where you use it: email, remote access, admin accounts, sometimes every cloud application.

What good looks like. You can name each place MFA is on, and you know where it is not. “Everyone, including the owner and the part-time bookkeeper” is something you can show. “I think we turned that on” is not. Pull a user list from your email admin console and look for anyone not enrolled.

What do the backup and recovery questions mean?

What it means. These questions ask whether you can get your data back after something goes wrong, and whether you have proved it. Forms commonly ask how often backups run, whether a copy is kept separate from your main systems, and when you last tested a restore.

What good looks like. A restore test is a real file or system brought back from backup, with a date and a note on how it went. A backup that has never been restored is a hope. Keep the test record where you can find it in two minutes. If your last test was years ago, run one before you answer.

What do the endpoint protection and EDR questions mean?

What it means. An endpoint is any laptop, desktop or server your people use. Older antivirus compares files to a list of known bad ones. EDR (endpoint detection and response) watches what software does and can stop suspicious behavior. Some forms ask which you have and whether it covers every device.

What good looks like. You can say which product runs on which devices, and you can list the exceptions. Helix Stax offers endpoint protection managed by Helix Stax on the devices we support. If you handle this yourself, the same test applies: a list of devices, a list of what is installed, and a named person who sees the alerts.

Should you patch, and how do you show it?

What it means. Software has flaws, and makers release fixes. Patching means applying those fixes. Not every form asks about it, but your carrier or agent may want to know how quickly you apply important updates, and it is worth being able to say whether that covers computers, servers, network gear and the software on top.

What good looks like. A stated routine, for example “operating system updates apply on a set schedule and urgent fixes get attention sooner”, plus a report that shows it happening. Be careful with software that is no longer supported by its maker. If you run any, say so plainly and tell your agent.

What are the email and remote access questions about?

What it means. Email is a common starting point for break-ins and payment scams, and remote access is a door into your network from outside. Forms commonly ask about email filtering and MFA on remote access. Some ask how staff reach files from home.

What good looks like. You can describe how a person at home reaches your files in two sentences, and you know what protects that path. For email, you know whether filtering for suspicious messages is on and who can change those settings.

What do the employee training and phishing questions mean?

What it means. Phishing is a fake message designed to get someone to click, pay or sign in. Forms commonly ask whether staff get security awareness training and how often. Some ask whether you test them with practice messages.

What good looks like. A dated record of who completed training, and a simple rule your people know: when a payment or password request feels odd, call the person on a number you already have. One video at hire and nothing since is easy to describe honestly. Describe it that way.

What do the administrator access questions mean?

What it means. Admin accounts can change settings, add users and reach everything. Forms commonly ask who has them. Some ask whether those people use a separate account for admin work and whether you review the list.

What good looks like. A short written list of admin accounts, each with a named owner and a reason. If a former employee, an old vendor or a shared login is on that list, take it off before you answer.

What do the business continuity and recovery plan questions mean?

What it means. A business continuity or recovery plan is a written answer to “what do we do if this happens?” Some forms ask whether you have one, whether anyone has read it, and whether you have ever practiced it.

What good looks like. It does not need to run fifty pages. One or two pages can do it: who makes decisions, who calls your IT provider and your insurance agent, where the backup copies live, and how to reach people if email is down. Print a copy. If your email is the thing that broke, a plan stored in your email is no help.

What is a ransomware supplement, and when does it appear?

It is an extra section some carriers add that goes deeper on ransomware: backups, remote access, EDR, and how fast you could recover. It may arrive with your renewal form. Ask your insurance agent whether yours has one.

The supplement asks the same kinds of things as the main form, in more detail. If you have collected the records above, you have much of what it needs.

What should I gather before I answer?

Get the current form early. Many offices see it a few weeks before renewal, or when they change carriers, which is not much time to find records. Then pull these:

• A list of who has MFA and where it is on
• The date and result of your last backup restore test
• A list of devices and the endpoint protection on each
• Your update routine and a recent report
• Your training record
• Your admin account list
• Your business continuity or recovery plan, or a note that you do not have one yet

Put each record next to the question it answers. Then read the whole form once before you answer any of it.

What happens if an answer turns out to be wrong?

We cannot tell you how a carrier treats a wrong answer under your policy. That depends on the policy and the carrier, and your insurance agent or an attorney can tell you. What we can say is practical: you sign the form, so each answer should match what your business does today.

If a control is not in place yet, say so and make a plan to close the gap. An honest “not yet” is a better thing to sign than a “yes” you cannot back up.

Where Helix Stax fits

Helix Stax is a managed IT provider in Hampton Roads. Our free IT assessment looks at your setup and shows where you stand on the controls these forms commonly ask about, such as MFA, backups, and endpoint protection.

We will explain the technical terms and show you what is true in your setup. We do not fill in, review, or submit your insurance form. The answers and the signature stay with you.

If the assessment shows gaps, we can set up the controls as services: MFA rollout, backup setup, endpoint protection managed by Helix Stax, and staff training, as part of our managed IT services. There is no obligation to hire us.

Book a free IT assessment