Cyber insurance security questionnaires: what small businesses are asked and how to prepare

Why insurers ask these questions

Ransomware and email fraud claims pushed carriers to look harder at basic security before they write or renew a policy. The questionnaire, sometimes called a ransomware supplement or security application, is how they decide whether to offer coverage, on what terms and with what exclusions.

The answers you sign usually become part of the application the policy is based on. Treat the questionnaire with the same care as a financial statement, not as a form to get through quickly.

Controls insurers commonly ask about

Wording varies by carrier, but these topics come up again and again:

• Multi-factor authentication (MFA). Usually asked separately for email, remote access (VPN, remote desktop), administrator accounts and cloud applications. "Yes for email" does not mean "yes for remote access."
• Endpoint detection and response (EDR). Software on computers and servers that detects malicious behavior and can stop it, going beyond traditional antivirus. Expect follow-up questions about which devices are covered and who reviews alerts, including nights and weekends.
• Backups. How often you back up, whether a copy is offline or immutable, whether backups use separate credentials, and whether and when restores have been tested.
• Patching. How quickly critical updates are applied, especially on internet-facing systems, and whether any systems run unsupported operating systems.
• Email filtering. Whether inbound email is scanned for phishing and malicious attachments, and whether you publish email authentication records (SPF, DKIM, DMARC).
• Security awareness training. How often staff are trained and whether you run phishing simulations.
• Incident response plan. Whether a written plan exists and whether it has been tested.
• Privileged access. Whether administrators use separate admin accounts, whether everyday users have local admin rights, and how many people hold top-level admin access.
• Payment controls. Whether changes to vendor bank details are confirmed by calling a known number before funds move.
• Remote desktop exposure. Whether remote desktop is reachable directly from the internet.

How to answer honestly when the answer is "partly"

Most small businesses have some of these controls on some systems, but the questionnaire often offers only yes or no. Follow a few rules:

1. Answer for the whole environment. If MFA covers email for everyone except two shared accounts, that is not a clean "yes."
2. Use the comments field or attach a short note when the honest answer needs context. For example: "MFA enforced for all users as of March 1; two service accounts excluded and restricted."
3. Answer based on what is true today, not what you plan to do. If a fix is scheduled for next month, say so, or finish it before you submit.
4. Ask your broker how to handle questions that do not fit your setup. Brokers see these forms constantly.
5. Have the person who knows confirm each answer. The owner often signs, but the IT provider usually knows whether a control is actually enforced. Get their confirmation in writing.

Why misstatements can put a claim at risk

When a claim comes in, the carrier may investigate how the incident happened. Suppose the application said MFA was enforced on remote access, and the attacker came in through a remote access account without MFA. That gap is likely to come up.

Depending on the policy wording and the facts, a misstatement can lead to a coverage dispute, a denied claim or rescission of the policy. How that plays out is a legal question for your broker and attorney, and this guide is not legal advice. The practical point is simple: an accurate "no" with a plan to fix it is safer than an optimistic "yes."

Evidence to gather before you fill it out

Collect proof, not memories. A folder with these items makes the questionnaire faster and gives you something to show if questions come up later:

• Screenshots of MFA enforcement settings in Microsoft 365 or Google Workspace, and a report showing MFA status for each user
• VPN and remote access settings showing that MFA is required
• A list of devices with EDR coverage, compared against your device inventory
• Backup job reports, plus a dated record of your most recent restore test and how long it took
• Patch status reports and a list of any unsupported systems, with notes on how they are isolated (see our segmentation guide)
• Email filtering and DMARC settings
• Training records: dates, attendees and topics
• Your written incident response plan and notes from the last tabletop exercise
• A list of administrator accounts and who holds each one

Date everything, and collect it again before each renewal.

A 30-day prep plan before renewal

• Week 1: Get the questionnaire from your broker early. Go through every question with your IT provider and mark each as yes, no or partial.
• Week 2: Close the quick gaps. Add MFA to remaining accounts and remote access, remove internet-facing remote desktop, and separate admin accounts from everyday accounts.
• Week 3: Run and document a restore test. Confirm that EDR coverage matches your inventory. Gather training records.
• Week 4: Write or update the incident response plan if needed, assemble the evidence folder, and complete the form, adding comments wherever an answer is partial.

Some fixes take longer than a month. Starting 60 to 90 days before renewal leaves room for them. Our incident response plan guide covers the plan most forms ask about.

Where an outside review fits

An independent review checks whether controls are actually enforced, not just turned on somewhere. It gives you a written, plain-language list of gaps before you sign. Keith Systems does this as part of a security risk assessment and can help you build incident response readiness.

We do not sell insurance, EDR software or equipment, so our advice is not tied to a product. If you are comparing providers, our guide on how to vet a security vendor may help. Businesses in Lompoc, Santa Maria and nearby can book a free security consult or call (805) 800-8163.