Renewal forms got harder
A few years ago, a cyber insurance application was a page of yes-or-no questions. Today many carriers ask detailed questions about how you sign in, how you back up, how you protect email and who has admin rights. Some are starting to ask how you control AI tools.
The answers affect whether you get coverage, what it costs and, most importantly, whether a claim gets paid. An answer that doesn't match reality can become a problem exactly when you need the policy.
What insurers commonly ask about
Every carrier's form is different, but these themes show up again and again.
Multifactor authentication
Whether MFA is required for email, remote access and admin accounts. "Mostly" is a common honest answer and a common gap. Admin and service accounts are often the exceptions nobody remembered.
Privileged access
How many people have admin rights, whether admin accounts are separate from everyday accounts and how they're protected.
Email security
Protection against phishing and spoofing, including email authentication records and filtering. Many incidents still start with a single email.
Backups
Whether backups exist, whether they're separated from the main environment and whether anyone has tested restoring them.
Endpoint protection and patching
Whether devices run modern security software and get updates on time.
Training and incident response
Whether staff get security awareness training and whether there's a plan for what to do when something goes wrong.
Where AI fits in
AI adds new questions to an old problem: where does your data go?
- Which AI tools do staff use, and are they business-grade tools with data protections?
- Is there a written AI use policy?
- Which third-party and AI apps have access to email and files?
- Would an AI assistant expose data because files are shared too widely?
Even where a carrier doesn't ask yet, clients, auditors and partners increasingly do. Having answers ready is good practice either way.
How to answer accurately
- Check the settings, don't rely on memory. Many wrong answers are honest mistakes.
- Answer the question asked. "Do all users have MFA" and "Do admin accounts have MFA" are different questions.
- Close gaps before renewal, not after. Knowing your renewal month lets you fix things in time.
- Keep evidence of when you checked and what you found.
- Work with your broker. They know what your carrier is looking for.
A note on what we don't do
We don't fill out insurance applications, and no assessment can promise coverage or a lower premium. What we can do is show you how your actual settings line up against the questions underwriters commonly ask, so the answers you give are accurate.
Where to start
Our free governance, security and compliance assessment takes about ten minutes and includes the insurance controls section, plus AI policy, identity and data sharing. It asks when your policy renews so any fixes can happen in time.
Take the free governance, security & compliance assessment
For Microsoft 365 businesses, our program adds a read-only scan and an insurance readiness summary refreshed before each renewal. See the AI Governance, Security & Compliance Program.