What security controls do cyber insurance applications ask about?

Cyber insurance applications have become detailed security questionnaires. Underwriters want to know how you stop account takeover, detect intrusions on your devices, recover from ransomware, keep fraudulent email out, and control administrator access. Each insurer writes its own questions, and they change between renewals, but the same core controls come up again and again. This checklist explains what each question is really asking, what evidence to keep, and which public guidance from CISA and NIST describes the control.

We do not cite insurer statistics here, and we do not claim to know what any particular carrier requires. Read your own application as written and confirm anything unclear with your broker.

Why do applications ask about these controls?

Insurers are pricing the risk that you will make a claim. The questions concentrate on the controls that public guidance treats as the basics against the most common attacks: stolen credentials, ransomware and payment fraud.

CISA's Cross-Sector Cybersecurity Performance Goals, now in version 2.0 and aligned to the NIST Cybersecurity Framework 2.0, are a short list of essential practices meant to help small and medium-sized organizations start with high-impact actions (CISA). The #StopRansomware Guide, published by CISA with the MS-ISAC, FBI and NSA, turns those practices into specific steps against ransomware and data extortion (CISA). Most application questions map cleanly onto one of those two documents.

How should you answer the application?

The application is a statement you sign about your environment. How an inaccurate answer affects your coverage depends on the policy wording and the law that governs it, which is a question for your broker or counsel, not for us. The practical rule is simple: answer only what you can show.

Three habits make the answers easier to stand behind:

• Read the exact wording. A question about MFA "for all remote access" includes vendor connections and remote management tools, not only the VPN.
• Ask the person who runs the control. If your IT provider manages backups, confirm the answer with them rather than assuming.
• Keep the evidence with the application. A dated screenshot, report or policy for each answer lets you show the position you described if anyone asks later.

Multi-factor authentication: where is it enforced?

MFA questions are usually split by where it applies: email, remote access, privileged or administrator accounts, and sometimes cloud applications and backups. Expect to be asked whether it is enforced for every user, not just available.

CISA has consistently urged organizations to implement MFA for all users and all services, including email, file sharing and financial account access. Its fact sheet on phishing-resistant MFA adds that not all MFA is equally secure: SMS and voice codes, and push notifications that users can approve by mistake, can be phished, intercepted or bypassed (CISA). CISA calls phishing-resistant MFA the gold standard and names FIDO/WebAuthn as the only widely available form. It urges system administrators and other high-value targets to move to it first.

NIST's current authentication guidance, SP 800-63B-4, requires a phishing-resistant authenticator at its highest assurance level, AAL3, and requires a phishing-resistant option to be offered at AAL2 (NIST).

What to keep: an MFA enforcement report from your identity provider, a list of any accounts excluded and why, and evidence that legacy authentication, which bypasses MFA, is blocked. If you use Microsoft 365, our Microsoft 365 hardening baseline covers the identity settings.

Endpoint detection and response: is every device covered?

Applications commonly ask whether you run endpoint detection and response (EDR) rather than traditional antivirus, whether it covers all laptops, desktops and servers, and whether someone monitors its alerts.

The #StopRansomware Guide recommends application allowlisting and/or EDR on all assets, and suggests considering EDR for cloud-based resources as well. The phrase that matters is "all assets". A tool installed on most devices leaves the rest as an easy way in.

The question about monitoring matters as much as the tool. EDR raises alerts; someone has to read them and act, including outside business hours if the application asks. Be precise about who that is and when they are available.

What to keep: a device inventory reconciled against the EDR console, a coverage report, and a description of who reviews alerts and how fast they respond.

Backups: are they protected and tested?

Backup questions usually ask how often you back up, whether copies are offline, segregated or immutable, whether backups are encrypted, whether backup systems use separate credentials and MFA, and when you last tested a restore.

CISA's guidance is direct. Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of those backups in a disaster recovery scenario. The guide explains why offline matters: many ransomware variants try to find and delete or encrypt any backups they can reach (CISA). It also notes that some cloud providers offer immutable storage, and cautions that immutable storage must be configured carefully. CISA's Cyber Essentials adds protections for backups such as physical security, encryption and offline copies (CISA).

A backup that has never been restored is an assumption. Test restores of a real system, time how long they take, and record the result.

What to keep: the backup schedule and retention settings, evidence of the offline or immutable copy, and a dated restore test with the system restored and the time it took.

Email security: how do you stop phishing and fraud?

Email questions often cover inbound filtering for malicious links and attachments, sender authentication with SPF, DKIM and DMARC, tagging of external messages, and the procedures you use to verify payment or bank detail changes.

The #StopRansomware Guide recommends flagging external emails in email clients, filtering at the email gateway, and implementing DMARC so that spoofed messages from your domain are less likely to be accepted. It also notes a limit worth knowing: DMARC protects your domain from being spoofed but does not protect you from incoming messages spoofing someone else's domain unless that domain also uses DMARC. CISA's BOD 18-01, written for federal agencies, sets the goal of a DMARC policy of p=reject, rolled out step by step while you monitor the reports (CISA).

Payment fraud is the other half of the email question. The FBI's Internet Crime Complaint Center describes business email compromise as a scam targeting businesses that work with suppliers or regularly make wire transfers, carried out by compromising email accounts and other communication channels to redirect funds. Its 2025 annual report lists business email compromise among the largest sources of reported losses, after investment fraud (FBI IC3). Insurers often ask whether you confirm payment changes through a separate, known channel, such as a phone number already on file.

What to keep: your DNS records for SPF, DKIM and DMARC, filtering policy settings, and a written payment verification procedure with evidence that staff follow it.

Privileged access: who holds the keys?

Applications commonly ask whether administrators use separate accounts for admin work, whether you limit how many people hold administrative rights, whether privileged accounts require MFA, and whether you use a privileged access management (PAM) tool.

The #StopRansomware Guide notes that attackers often use privileged accounts to spread ransomware across a network. It recommends least privilege across all systems and services, separate administrator accounts from user accounts, quarterly audits of user and admin accounts for inactive or unauthorized access, and a PAM solution on domain controllers to manage, log and alert on privileged access. It also calls out review of remote monitoring and management accounts, including access given to managed service providers.

What to keep: a current list of privileged accounts and their owners, the date of the last access review, and evidence that admin accounts are separate and protected by MFA.

What else do applications ask about?

Beyond the five main controls, three topics appear often.

Patching and unsupported software. Expect questions about how quickly you apply critical patches and whether you run software that no longer receives security updates. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities exploited in the wild, and CISA advises using it as an input to patch prioritization (CISA). Software past its vendor's end of support no longer receives fixes, so list it and plan its replacement.

Incident response plan. CISA recommends creating, maintaining and regularly exercising a basic incident response plan and communications plan, with a hard copy and offline version available. Its free tabletop exercise packages are a starting point for testing the plan (CISA). Some applications also ask whether the plan names who to call first. Check whether your policy specifies a notice process or approved incident response firms, and put those contacts in the plan.

Training. Applications ask whether staff receive security awareness training and phishing simulations. CISA recommends a training program that teaches staff how to identify and report suspicious activity, repeated regularly.

Some applications also ask whether you have had a recent penetration test or vulnerability scan, and whether a named person is responsible for security. The NIST Cybersecurity Framework 2.0 treats that ownership as part of its Govern function, alongside Identify, Protect, Detect, Respond and Recover (NIST).

The checklist

Control	What applications typically ask	Evidence to keep	Guidance
MFA	Enforced for email, remote access, admins and cloud apps? Which method?	Enforcement report, exception list, legacy authentication blocked	CISA phishing-resistant MFA fact sheet; NIST SP 800-63B-4
Endpoint detection and response	EDR on all endpoints and servers? Who monitors alerts?	Coverage report reconciled to the device inventory; monitoring arrangement	#StopRansomware Guide
Backups	Offline or immutable copy? Encrypted? Separate credentials? Last restore test?	Backup settings, offline copy evidence, dated restore test	#StopRansomware Guide; Cyber Essentials
Email security	Filtering? SPF, DKIM, DMARC? External tagging? Payment verification?	DNS records, filter policy, written payment procedure	#StopRansomware Guide; BOD 18-01; FBI IC3
Privileged access	Separate admin accounts? MFA on admins? PAM? Access reviews?	Privileged account list, review records	#StopRansomware Guide
Patching	Time to apply critical patches? Unsupported software?	Patch reports, end-of-support list with replacement plan	CISA KEV catalog
Incident response	Written plan? Tested?	Plan, tabletop exercise notes	#StopRansomware Guide; CISA tabletop packages
Training	Awareness training and phishing simulations?	Completion records, simulation results	#StopRansomware Guide

Where to start

Pull last year's application and this year's renewal form, and mark every question you cannot back with evidence today. Fix MFA gaps on email, remote access and admin accounts first, since CISA urges those accounts to move first and the changes are usually quick. Then confirm EDR coverage against your device inventory and run a real restore test.

Our managed security service runs endpoint security, email security and cloud security, working alongside your IT provider rather than replacing them. We configure and monitor the controls, and give you documentation to support the answers on your application. We cannot promise an underwriting decision, but we can make sure your answers describe what is actually in place. If no one owns the questions, a virtual CISO can take on that role. If a renewal is close, talk to us about the gaps.