For CFOs: Answering the Cyber Insurance Application Honestly

Cyber insurance applications have changed. A few years ago they asked a handful of general questions. Now they read like a security audit: Do you require multi factor authentication for remote access? For email? For privileged accounts? Are backups kept offline or immutable? Do you have endpoint detection and response on every device? Is there a written incident response plan?

Those questions usually land on the CFO's desk because insurance sits with finance. The CFO signs, or the owner signs on the CFO's recommendation. And here is the part that deserves attention: every one of those answers is a statement of fact about how the business operates. If the answer is wrong, the problem may not surface until you file a claim.

This guide is for CFOs and owners who want to answer the application honestly and use it as a useful check on the security program.

Read the application as a list of control statements

Treat each question as a claim that has to be true across the whole business, not just in most places. "We require MFA for all remote access" is a broad statement. It covers the VPN, the remote desktop gateway, the vendor support tool, the cloud accounting system, the payroll portal, and the IT provider's management tools. If one of those does not have MFA, the answer is no, or at least "not entirely," and the application usually has a place to explain.

A useful exercise is to rewrite each question as a sentence that starts with "We" and ask whether you would be comfortable defending it to someone who does not know your company. If the honest answer is "mostly," you need more detail before signing.

Questions that commonly cause trouble

Without guessing at any particular carrier's form, these are the topics that tend to produce inaccurate answers:

MFA scope. The application may ask about MFA separately for email, remote access, privileged or admin accounts, and cloud services. Businesses often have MFA on email and assume the rest is covered. Admin accounts and backup systems are frequent gaps.

Backups. Questions often ask whether backups are separated from the network, encrypted, immutable, and tested. "We have backups" is not the same as "we have backups that ransomware cannot reach and that we have restored from recently." Our post on restore testing walks through what a real test looks like.

Endpoint protection. The form may distinguish between traditional antivirus and endpoint detection and response. Make sure you know which you have and whether it covers servers as well as laptops.

Patching and end of life systems. Some applications ask whether any unsupported operating systems or software are in use. A single old server running a legacy application can make that answer false.

Incident response plan. "Do you have a written plan?" usually implies a plan that is current and that people know about. Our COO guide to downtime is a good companion here.

Training. Questions about phishing training may ask about frequency and whether it includes simulated phishing.

Vendors. Some forms ask about how you manage third parties with access to your systems. Our vendor management policy guide covers the basics.

A process that works

We suggest a simple routine every time an application or renewal arrives:

1. Send the full application to IT before anyone fills it in. Whether IT is internal or outsourced, ask them to answer every technical question in writing with a short note on how they know.
2. Ask for evidence on the high impact items. For MFA, a report or screenshot showing enrollment across systems. For backups, the date and result of the most recent restore test. For endpoint protection, the count of protected devices compared to the asset inventory.
3. Compare the answers to last year's application. If last year you said yes to something and nothing has changed, confirm it is still true. If you said yes and later found out otherwise, fix it now.
4. Use the explanation fields. If a control is partly in place, say so and describe what is underway. Talk with your broker about how best to present partial coverage.
5. Keep a copy of what you submitted along with the evidence. If you ever need to show what you knew and why you answered the way you did, that file matters.

Why this belongs in risk management, not only procurement

The NIST Cybersecurity Framework 2.0 places risk management strategy in its Govern function, under GV.RM. One part of that is deciding which risks you will reduce with controls and which you will transfer, for example through insurance. Insurance is a legitimate risk transfer tool, but it only works if the policy responds when you need it, and the controls you described are part of the basis for that coverage.

Seen that way, the application is a useful annual check on whether your security program matches what leadership thinks it is. When a CFO asks IT, "Can we honestly say yes to this?", the answer often reveals gaps that nobody had raised.

When the answer is no

If you discover that a control the application asks about is not in place, you have a few honest options:

• Answer accurately and explain the plan to address it.
• Close the gap before submitting if it is a quick fix, such as turning on MFA for an admin portal.
• Ask your broker whether the carrier will accept a compensating control or a dated commitment.

What you should not do is check yes and plan to fix it later. The application is signed as of the date you submit it.

We do not give legal or coverage advice. How a specific policy responds is a question for your broker and, if necessary, your attorney. Our role is to help make sure the technical facts you report are accurate.

What to ask your IT provider

A short list for the next renewal:

• Which systems in our environment do not have MFA enforced today, and why?
• When did we last restore data from backup, and what did we restore?
• Is there any device without endpoint protection, including servers?
• Are we running any operating system or application that no longer receives security updates?
• Where is our written incident response plan, and when was it last reviewed?
• Which vendors can connect to our network remotely, and how is that access protected?

If the answers come back quickly and with evidence, you are in good shape. If they come back vague, that is the work to do before you sign.

Our vCISO service includes helping leadership prepare for insurance renewals, and our compliance checklist covers many of the same controls carriers ask about. If renewal season is coming and you want a second set of eyes on the application, book your free risk review.