How do we answer our cyber insurance questionnaire honestly?

Cyber insurance applications ask specific technical questions: multi factor authentication on email and remote access, offline or immutable backups, endpoint detection, patching cadence, security awareness training, whether you have an incident response plan.

The temptation is to answer the way that gets the policy. Do not. Those answers form part of the contract, and if you claim after an incident and the insurer establishes that a control you attested to was not actually in place, that is a well-trodden route to a reduced or denied claim. The moment you need the policy is the moment those answers get examined.

What we do: go through the questionnaire with you, tell you honestly which answers are currently yes, which are no, and which are partly, then quote the gaps so you can decide what to close before submitting. Some are free and take an afternoon, multi factor being the obvious one.

We will also say when a question is ambiguous, because several are. "Do you have offline backups" means something specific, and the right answer depends on how yours are actually configured, not on the marketing term the vendor uses.

Worth doing this before renewal rather than in the last week, because the gaps you find sometimes take longer to close than you have.