An image of the mid torso of a suit clad man at a desk with a pen in hand completing a form. The words Cyber Insurance Questionnaire. The Most Important Things to Know and featured next to that image. Text and background colors are in blue tones.

What Do I Need To Know About Completing A Cyber Insurance Questionnaire?

June 16, 2026
SkylineIT
Business Smarts, Cybersecurity, Security

If you’re renewing or applying for cyber insurance, you’ve probably noticed the questionnaire is longer and more detailed than you expected. That’s not busywork. Every section maps to a real incident that cost a carrier money, and how you answer directly affects your premium, your coverage limits, and whether your policy will actually pay out when you need it. Even if you don’t read our whole post, take this away: be honest and accurate when completing these questions! Should a cyber incident occur, your insurance company’s willingness to pay depends on it.

Here’s what to know before you sit down with it.

The Questions Are More Specific Than They Used to Be

A few years ago, most cyber insurance applications were a page or two. Today, they’re closer to five or ten and the questions have teeth. Carriers reshaped their applications after high-profile breaches like MOVEit, Change Healthcare, and the Arup deepfake wire fraud. If your business handles client funds, sensitive records, or protected data, expect a thorough questionnaire.

The good news: none of these are trick questions. They’re asking whether specific protections are in place, and the honest answer is always the right one. If you do not understand what they are asking, make sure you find out before you answer. We will try to cover the most common topcis.

Multifactor Authentication (MFA) Gets Its Own Section Now

MFA used to be a single checkbox. Now you’ll be asked whether it’s enforced on email, VPN, remote desktop, admin accounts, and service accounts individually. Carriers want “yes” across the board.

A few things worth knowing:

SMS-based MFA is losing favor. Carriers increasingly prefer authenticator apps, hardware tokens, or push notifications with number matching.
Admin accounts get extra scrutiny. You may see questions about privileged access management (PAM), whether admin credentials are vaulted, rotated, and logged.
A gap won’t necessarily get you denied, but expect higher premiums or coverage exclusions tied to unprotected entry points.

Backups Are No Longer a Yes-or-No Question

You’ll be asked whether your backups are immutable or air-gapped, when they were last tested, and whether compromised admin credentials could wipe them.

An immutable backup can’t be deleted or altered during a set retention window, even by someone with stolen access. If your backup lives on a device connected to the same network with no recent restore test, that’s going to raise questions.

One important note: native Microsoft 365 retention alone won’t satisfy this section. Carriers are looking for a dedicated backup solution with protections beyond what’s built in.

Wire Transfer Verification Is on the Form

After a wave of business email compromise losses and a deepfake incident where AI-generated executives tricked an employee into transferring over $25 million, carriers now ask whether your organization requires out-of-band callback verification before sending wires.

That means calling the recipient at a number you already have on file, not the one in the email requesting the transfer. Some applications also ask whether staff have been trained on AI voice cloning and deepfake video risks.

A strong answer includes a written wire transfer policy, dual approval, and documented training. Informal practices without documentation will usually get flagged.

“We Have Antivirus” Won’t Be Enough

The questionnaire will ask about Endpoint Detection and Response (EDR), software that monitors behavior on each device and flags suspicious activity in real time. It may also ask about Managed Detection and Response (MDR), which adds a 24/7 security team monitoring and responding to those alerts.

If you’re still running traditional antivirus alone, be upfront about your timeline for upgrading. Underwriters can work with a specific plan. They can’t work with vague intentions.

Expect Questions About Your Software Vendors

After the MOVEit supply-chain breach affected thousands of organizations, carriers want to know who your key vendors are, what data they can access, and whether they’ve provided a security report.

You’re not expected to audit every vendor. But you should be able to name your top five and show you’ve asked the right questions. An honest answer like “we’ve identified our top vendors and requested reports from three” reads much better than a confident claim that doesn’t hold up later.

Honesty Matters More Than a Perfect Score

This is the most important thing to understand: a cyber insurance application is a warranty document. If a forensic investigation after a claim finds that your environment didn’t match what you declared, the carrier can rescind the policy entirely meaning your claim is denied and prior payouts must be refunded.

If you have a gap, declare it and include a remediation date. A higher premium is a predictable cost. A voided policy after a breach is not.

A Simple Pre-Renewal Checklist

Most of this process is achievable in about 30 days if you start now:

Week 1: Confirm MFA is enforced on email, VPN, remote desktop, admin accounts, and service accounts. Move admin MFA, ideally all MFA, off SMS.
Weeks 1–2: Verify backups are immutable or air-gapped. Run a test restore and document the results.
Week 2: Write a one-page wire transfer policy with callback verification and dual approval.
Weeks 2–3: Confirm EDR covers every endpoint and server. If you only have antivirus, get quotes for EDR or MDR.
Week 3: Identify your top five software vendors and request security reports.
Weeks 3–4: Update your incident response plan. Run a short tabletop exercise and keep the notes.
Week 4: Sit down with the questionnaire and answer honestly. Flag anything unresolved with a target remediation date.

You Don’t Have to Fill It Out Alone

A good managed IT partner should be able to sit down with you, walk through each section of the questionnaire, identify where your environment stands today, and help you build a realistic plan for anything that needs attention. That’s the kind of thing we do at Skyline not because insurance is our business, but because your technology environment is, and these questions are really about whether your IT security baselines are solid.

We also provide compliance services so that you always have clear, defensible documentation such as policies, a WISP (written information security plan), and even penetration testing to demonstrate what you and your staff are doing to maintain a cybersecurity posture in your business.