When a client or prospect brings us their cyber insurance renewal, the questions they’re stuck on are usually about settings and acronyms. Multi-factor authentication (MFA) comes up most: the form asks whether it’s on everywhere, in some places, or nowhere, and the partner or office manager filling it out has no way to know for sure.
Those questions are where cyber insurance requirements for small business show up in practice: a list of security basics the insurer expects you to have, such as MFA, backups, and endpoint protection, written as yes-or-no questions you sign your name to. Below, we go through what each question is checking, why so many “yes” answers turn out to be only partly true, what happens when an insurer finds out, and how to check your answers before you sign.
Your questionnaire answers are statements the insurer relies on when it decides whether to pay a claim, so check each one against your systems before you sign, and answer “partially” when that’s the truth.
What the Questionnaire Is Asking
Insurers want to see basic cybersecurity best practices in place before they take on your risk. The insurance broker Marsh notes that some controls are now a minimum requirement for insurers. Each carrier words its form differently, but the same handful of controls shows up on most of them.
| Control | How the form usually asks | What the insurer wants to know |
|---|---|---|
| Multi-factor authentication | Is MFA required for email, remote access, and admin accounts? Often with “everywhere / some / none” choices. | Whether a stolen password on its own is enough to get in. |
| Backups | Is a copy kept offline or separate from your network? When was a restore last tested? | Whether you could recover from ransomware without paying the ransom. |
| Endpoint protection | Do all computers and servers run endpoint detection and response (EDR)? | Whether an attack on one laptop would be spotted and stopped before it spreads. |
| Patching | How quickly are critical security updates installed? | Whether attackers can walk in through a known, already-fixed hole. |
| Email security | Is incoming email filtered? Are SPF, DKIM, and DMARC set up for your domain? | How much phishing reaches your staff, and whether someone can send email pretending to be you. |
| Security awareness training | Do employees get training or phishing tests? How often? | Whether your staff would recognize a fake invoice or login page. |
| Incident response plan | Do you have a written plan for a cyber incident? | Whether you’d know who to call in the first hour, including the insurer’s own breach hotline. |
Why “Yes” Is Usually Only Partly True
When a firm checks “yes” on MFA, what we usually find is that it’s on in some places but not everywhere. The partner who filled out the form believes it’s everywhere because they approve a sign-in on their own phone every day. What they can’t see is the shared mailbox nobody set it up for, the remote desktop connection a vendor opened years ago, or the admin account that only gets used a few times a year.
Tools and policies slip the same way. A firm says it has endpoint protection, a backup policy, or security training because something like that was put in place at some point. Since then, new laptops arrived without the software, the backup stopped covering Microsoft 365, or the training happened once and never again. The people answering these forms usually answer from what they believe is in place, without the technical background to know where the gaps are.
What Happens When an Answer Turns Out to Be Wrong
Premiums can go up when the insurer learns that a control you said you had isn’t there. Coverage can be refused outright if you fall below the carrier’s minimum requirements. And after an incident, the insurer will look for reasons to deny the claim, and an inaccurate answer gives them one. Claims have been rejected because the answers on the questionnaire weren’t accurate, even when the client never meant to answer falsely.
One public example is from 2022. An electronics manufacturer, International Control Services, had stated on its application that it used MFA to protect administrative and privileged access. After a ransomware attack that May, its insurer, Travelers, found that MFA protected only the firewall and asked a federal court to rescind the policy. By the end of August, the two sides agreed to void the contract, leaving the company without coverage for the attack.
We see the same pattern on renewals: MFA turned on in one place, answered as if it covered everything. The gap tends to surface at claim time, because the forensic investigation after an incident usually shows what was set up on the day of the attack.
Check Your Answers Before You Sign
Keep your questionnaire next to you and work through the checker one control at a time, picking the choice that matches what’s in place today. For each control it shows what to put on the form, where gaps usually hide, and what to confirm first. You can print the list or download it for whoever is helping you with the renewal.
Questionnaire Answer Checker
For each control your cyber insurance form asks about, pick the choice that matches what’s in place today. You’ll get what to put on the form, where gaps usually hide, and a list to print or download.
The interactive checker needs JavaScript. You can still use it as a manual review: for each control below, decide whether a true “yes, everywhere” describes your firm, and confirm anything you’re unsure of before you sign.
Your before-you-sign list
This is a self-check, not a security assessment, and carriers word their questions differently. Nothing you enter is sent or saved; refreshing the page clears it. Don’t enter passwords, account names, or client information in the notes.