Cyber insurance questionnaires: what insurers ask and how to answer accurately

Why the answers matter

In 2022 the insurer Travelers asked a US court to cancel a cyber policy it had issued to International Control Services, a company in Illinois, after a ransomware attack. The company’s chief executive had signed an application saying multi-factor authentication protected email, remote access and admin accounts. Travelers said its investigation found MFA only on the firewall. The two sides agreed, and the court rescinded the policy, which left the company without cover for the attack.

Insurance law in Cayman differs from Illinois, but every insurer prices and accepts a policy on the strength of what you tell it. Your broker can explain how the duty to disclose applies to your own policy.

What insurers usually ask

• Multi-factor authentication for email, remote access, admin accounts and backups.
• Endpoint detection and response (EDR) on every laptop, desktop and server, and who watches its alerts.
• Backups that are encrypted, kept separate from your network so ransomware can’t reach them, and tested by restoring.
• How quickly critical security updates are installed, and whether any systems are out of support.
• Email security, such as filtering and DMARC, and how payment requests are checked.
• Staff security training and phishing simulations.
• Whether staff work day to day without admin access to their own PCs.
• An incident response plan that has been written down and rehearsed.
• Which suppliers have remote access to your systems, including your IT provider.

Common traps

• Saying MFA is on everywhere when a shared mailbox, an old server or a scanner account doesn’t use it.
• Ticking “daily backups” when nobody has tried restoring from them for a year.
• Calling ordinary antivirus EDR. Insurers usually mean a tool that records activity and lets someone respond to an attack.
• Answering for your IT provider without asking them. They know which tools are in place and can usually show you a report.
• Filling in the form in the last week before renewal, when there’s no time to fix anything.

How to prepare before renewal

1. Ask your broker for the form at least two months before renewal.
2. Go through every question with your IT provider or IT manager.
3. Collect evidence, such as MFA and backup reports, so each answer can be backed up if the insurer asks.
4. Where something is partly in place, say so and add a note explaining what’s covered and when the rest will be done.
5. Fix the quick wins, then tell your broker what has improved since last year.
6. Keep a copy of the signed form with your IT documentation, so next year’s answers start from the same place.

What it means in Cayman

Many cyber policies give you access to breach lawyers and forensic investigators when something goes wrong. In Cayman, a personal data breach has to be reported to the Ombudsman and the people affected within five days under the Data Protection Act, and CIMA-regulated businesses have their own incident reporting duties. Check that the insurer’s response team can act quickly here, and that your own incident response plan names who calls them.

How CNS can help

We help clients complete cyber insurance questionnaires every renewal. As part of our IT consulting and virtual CIO services, we check each answer against your actual set-up, gather the evidence and give you a short list of gaps to close, in order of priority. Many of the controls insurers ask about, including MFA, EDR and backups, are part of our managed IT plans.