For many small businesses, the first serious conversation about cyber security doesn't come from an IT provider. It comes from an insurance broker. You sit down to renew or take out a cyber policy, open the proposal form, and find yourself staring at questions about multi-factor authentication, offline backups and endpoint detection that you're not quite sure how to answer.
You're not alone, and it's worth taking seriously. Insurers have become much more specific about the controls they expect to see, and the answers you give can affect whether you're offered cover, what you pay and, crucially, whether a claim is paid out later. Here's a plain-English guide to what insurers typically ask and why.
Why insurers ask so many IT questions
Cyber insurers are trying to judge how likely you are to suffer a costly incident, such as ransomware, a compromised email account or a fraudulent payment. Over time they've learned which basic controls make the biggest difference, so the questionnaire is essentially a checklist of those controls.
One point matters above all: answer honestly. If you tick "yes" to something that isn't really in place, and that gap turns out to be relevant to a claim, the insurer may be entitled to reduce or refuse the payout. It's far better to say "not yet" and fix it than to guess.
The questions you're most likely to see
Every insurer words things differently, but most proposal forms cover the same core areas.
Multi-factor authentication (MFA)
Expect questions about whether MFA is switched on for email, remote access and administrator accounts. MFA means that a password alone isn't enough to log in; you also need a code from your phone or an app. It's one of the most effective protections against stolen passwords, which is why insurers focus on it so heavily.
The catch is that "we have MFA" is often only partly true. It might be on for some staff but not others, or on for Microsoft 365 but not for the remote desktop connection your accountant uses. Insurers usually mean all users, all the time.
Backups
You'll likely be asked how often you back up, where backups are stored, whether they're kept separate from your main network, and whether you've tested restoring them. Ransomware commonly tries to encrypt or delete backups too, so insurers want to know at least one copy is offline, immutable (cannot be altered) or otherwise isolated.
A common surprise: many businesses assume Microsoft 365 is automatically backed up. Microsoft keeps the service running, but long-term, point-in-time backup of your mailboxes and files is generally your responsibility.
Patching and software updates
Insurers ask whether operating systems and software are kept up to date, and how quickly critical security updates are applied. They may also ask whether you're running anything that's out of support, such as an old version of Windows or an ageing server that no longer receives security fixes.
Antivirus and endpoint protection
Basic antivirus is now often not enough on its own. Some insurers ask specifically about endpoint detection and response (EDR), which monitors devices for suspicious behaviour rather than just known viruses, and whether someone is actually watching the alerts.
Email security and staff awareness
Because so many attacks start with a convincing email, you may be asked about spam and phishing filtering, and whether staff receive regular security awareness training. Questions about payment procedures are common too, for example whether you verify changes to supplier bank details by phone.
Remote access and admin rights
Expect questions about how staff connect from home and whether any systems are directly exposed to the internet, such as remote desktop. Insurers also like to see that everyday users don't have administrator rights on their computers, and that admin accounts are kept separate and protected.
Incident response and certification
Some forms ask whether you have a written plan for what to do if something goes wrong, and whether you hold Cyber Essentials or Cyber Essentials Plus. Certification isn't always required, but it can demonstrate that the basics are in place and may help the conversation with your insurer.
What to do if you find gaps
Discovering gaps is normal and nothing to be embarrassed about. The sensible approach is:
- Be honest on the form, and tell your broker what you're planning to fix and by when.
- Prioritise MFA and backups first, as these are frequently the deal-breakers.
- Get written confirmation of what's in place, so you can answer future renewals with confidence.
- Review your setup annually, because questionnaires tend to get stricter over time.
Many of these controls are inexpensive or already included in licences you pay for, such as features within Microsoft 365 that simply haven't been switched on. Others, like isolated backups or EDR, involve a modest ongoing cost. Exactly what you need depends on your size, your systems and what your insurer is asking for.
How an IT provider can help
A good IT support partner can go through the questionnaire with you, explain what each question really means, check what's actually configured, and put the missing pieces in place. Just as importantly, they can keep those controls working, so the answers you give this year are still true at the next renewal and on the day you might need to claim.
If you're facing a cyber insurance form and aren't sure how to answer it, we're happy to help. Get in touch with the Cloud 4 Sure team in Worthing, or book a free IT health check, and we'll give you a clear, jargon-free picture of where you stand and what to fix first.