Checklist
A Cyber Insurance Readiness Checklist
Review the controls insurers commonly ask about before an application, including multi-factor authentication, backups, endpoints, privileged access, and incident response.
A cyber insurance application is easier to answer when the organization already knows which controls are in place and which ones are only planned. This checklist covers questions insurers commonly ask. It does not guarantee coverage, a premium, or a claim outcome, and it is not legal advice.
Start from the application
Collect the questions the carrier or broker actually sent. Different applications emphasize different controls, so a generic list is only a starting point.
- Save the application, any security questionnaire, and the deadline.
- Note which answers need evidence, such as a screenshot, a policy, or a recent test result.
- Assign one owner to collect answers so the same control is not described two different ways.
Check the controls commonly asked about
Insurers often ask whether everyday safeguards are actually working, not only whether a product was purchased.
- Multi-factor authentication on email, remote access, and administrator accounts.
- Backups that include a protected or offline copy, plus a recent restoration test.
- Endpoint protection on supported workstations and servers.
- Separate administrator accounts, with privileged access limited to the people who need it.
- A written incident response plan that names who to call and how to reach them.
Separate evidence from intention
An honest gap is more useful than an answer the organization cannot support later. If a control is planned but not in place, say that.
- Record the system, the date, and the person who confirmed each answer.
- Flag controls that apply only to part of the environment.
- List the gaps that would change an answer, and the work required to close them.