Get the free guide

For whoever fills in or signs the cyber insurance application

Before you sign your cyber insurance renewal

Each answer on the security section is a statement about how your office runs today. The guide explains what each question is asking and what to check with whoever runs your IT.

  • Eight sections, each with a short list of things to check before you sign
  • You can go through it with your IT provider or whoever handles IT in your office
  • You don't need to talk to anyone to get it

Get the free guide

Tell us where to send it.

What a yes on the form commits you to

The questions look like yes-or-no boxes. If a claim comes in and the insurer finds an answer didn't match what was in place, it can refuse the claim or cancel the policy.

  1. 1

    Who signs

    The form asks an owner or officer to sign it, and sometimes the person responsible for IT as well. Before either of them signs, go through each answer with the person who actually runs your systems.

  2. 2

    "Most staff" isn't a yes

    On two-step sign-in, yes means every account in that group, every time someone signs in. If the owner, a shared front desk login or an old account a former employee used can get into email without a code, the honest answer isn't yes yet.

  3. 3

    What happened to one manufacturer

    In 2022, an Illinois manufacturer answered yes to using two-step sign-in. After a ransomware attack, the insurer found it was only on the firewall, not on the server that was hit, and cancelled the policy as if it had never existed.

What's in the guide

Eight groups of questions and what to check for each

Each section explains what the form is asking and what a yes commits you to, then lists what to check with whoever runs your IT. Here's one check from each.

Two-step sign-in

Many forms ask separately about email, remote access, administrator accounts and backups. The checklist covers shared front desk logins, seasonal staff and floor staff who can't carry a phone.

Email filtering

Is screening turned on for every mailbox, including shared ones like info@ and billing@? Some forms also ask whether staff can read work email on a personal laptop.

Attack detection on every computer

Count the computers in your office, then count the ones in the security software's list. The two numbers should match, and that includes the PC that runs a machine on the floor.

Backups

The first question on the checklist is when someone last restored a file from the backup and timed how long it took.

Administrator accounts

Staff should do their daily work without administrator rights. Look for old administrator accounts that belonged to someone who left or to a past IT provider, and check that client or patient data on laptops is encrypted.

Staff training

If the form says quarterly, you should be able to show four training dates from the past year and who missed them.

Out-of-date systems

A yes means nothing in the office runs a system that has stopped getting security updates, unless you've told the insurer. Windows 10 stopped getting free security updates in October 2025, and Windows Server 2016 support ends Jan. 12, 2027.

A written plan for an attack

For most offices, the first call is the insurer, before anyone pays or wipes anything. The plan should say so, list names and phone numbers and be saved somewhere you can reach if your own systems are locked.

Get the guide before you fill in your renewal

Go through it with whoever runs your IT before anyone signs.

Send me the guide

If the application is already on your desk

Bring the application to a free review before you sign

A cybersecurity expert will go through it with you, question by question, and tell you in writing which answers hold up today and what would need to change for the rest. You don't need to send it to us. It's free and you keep the written findings. You and your broker decide the final answers.

Book a free security review

Bring the application to the review. You don't need to send it to us. We'll contact you to set a time.

Questions about the guide and the review

Do I need to know IT to use the guide?

No. Each section tells you what to ask the person who runs your systems, whether that's an outside provider or someone in your office.

Will it match my insurer's form?

Not word for word, because every insurer writes its own form. The guide groups the questions the way they show up again and again across carriers, so your form may split one into three or use a different word for the same thing.

Is this legal or insurance advice?

No. Your broker can tell you what your policy requires and how your insurer reads each question.

What if our IT provider says every answer is yes?

Go through each section with them and ask for their answers in writing. If an outside IT provider won't put its answers in writing, that tells you something too.