The cyber insurance application used to be two pages and mostly about revenue. Now it asks whether multi-factor authentication is on for email, remote access, and administrator accounts. Whether backups are tested and stored where an attacker cannot reach them. Whether endpoint protection is on every machine. Whether staff finish security training. Somebody checked all those boxes and signed.
The question worth sitting with is whether those answers are still true today. Carriers keep getting better at checking, and the pressure runs one direction: toward verifying what you claimed instead of taking your word. That is not a scare story. It is what happens when an insurance line matures. It does mean the form you filed is a set of commitments you should be able to evidence.
One thing up front, and we mean it. This is general information, not legal or insurance advice. Policy terms vary enormously between carriers, between years, and even between two policies from the same company. Nothing here tells you what your policy says or how your carrier would treat a claim. Your broker or carrier has to confirm specifics. We can speak to the technical side: what the questions are really asking, and how to stay able to answer them honestly.
Underwriting Turned Into a Technical Review
Two forces reshaped these applications. The first is money. In its 2024 cyber insurance report covering the 2023 data year, the National Association of Insurance Commissioners reported 9.84 billion dollars of direct written premium for cyber insurance coverage in the United States, with the U.S. accounting for 59 percent of the 16.66 billion dollars in cyber premium written globally in 2023. That same NAIC report described insurers raising rates significantly and tightening terms and conditions, specifically by increasing deductibles and adding sub-limits.
The second force is regulatory. In Insurance Circular Letter No. 2, issued in 2021, the New York Department of Financial Services set out a Cyber Insurance Risk Framework directing insurers to maintain a data-driven, comprehensive plan for assessing the cyber risk of each insured and potential insured, and to gather information detailed enough to make a rigorous assessment of potential gaps and vulnerabilities. That is a regulator telling insurers, in writing, not to take applicants at their word.
Put those together and you get the application you filled out. It is not a formality. It is the underwriting file, and it is what everyone reaches for when something goes wrong.
The Gap That Bites Is the Control That Lapsed
Almost nobody lies on these forms. What happens is more mundane and easier to miss: you were completely honest in January, and then the environment moved underneath you.
- A new system that missed the rollout. A server stood up for a project, never enrolled in endpoint protection because it was supposed to be temporary. It is still running.
- An exception that never closed. Multi-factor authentication got switched off for one executive during a miserable travel week. Nobody turned it back on.
- A vendor swap with different defaults. You changed backup products and the new one shipped with shorter retention than you described on the form.
- Turnover. The person who chased people to finish security training left, and nobody inherited it.
- Growth. A new office, an acquisition, or a remote team with its own equipment and habits, none of which existed when you answered the questions.
An insurance application is a point-in-time statement about a system that changes every week. That is a structural problem, not an integrity problem. What it means for coverage depends entirely on your policy language and your state’s law, which is exactly the kind of question we will not guess at. Ask your broker directly, in writing.
Keep Evidence That Your Controls Are Actually Running
The practical fix is not more security tools. It is proof the ones you described are doing what you said. There is a real difference between believing you have multi-factor authentication and producing a report showing exactly which accounts have it.
- An MFA coverage report. Not a claim, a count. How many accounts are enrolled, how many are not, and a reason for every exception.
- Backup test records. Date, which system, who ran it, how long it took, whether the data opened afterward. Four columns in a spreadsheet is enough.
- Training completion records. Names and dates, including new hires, who are most likely to fall through.
- An endpoint deployment report. Devices running the agent compared against devices you actually own. The gap is the interesting part.
- A short exception log. When you granted an exception, why, and when you closed it. This one habit prevents most of the surprises above.
Store these outside the systems they describe. Evidence in a folder on the file server that just got encrypted is not evidence you can hand anyone. If MFA is the question you are least sure about, our explainer on the differences between security keys, passkeys, and ordinary MFA covers what carriers are usually asking about.
The Annual Self-Check Before Renewal
Give yourself sixty to ninety days before renewal and run this. It takes a morning.
- Pull last year’s application out of the file. Most businesses never reread it. That alone is worth the exercise.
- Answer every question again from evidence, not memory. Open the console, pull the report. Memory is where gaps hide.
- Flag every answer that changed. Change is normal. Unnoticed change is the problem.
- Fix what you can before you file. Turning MFA back on for one account takes minutes and moves an answer to yes.
- Tell your broker about anything you cannot fix. A harder conversation at renewal beats a surprise later, and a good broker would rather help you position it than find out afterward.
- Save the evidence with the application. Same folder, same date, so next year takes an hour.
The Application Is a Better Checklist Than Most Frameworks
Here is the honest opinion, and it is a little contrarian. Most small businesses that adopt a formal security framework abandon it by spring. Those documents are comprehensive, which is another way of saying long, and that is exactly wrong for a company with fourteen employees and no security staff.
The insurance application does not have that problem. It is short, specific, and written by people whose business is paying claims. That gives them a strong financial reason to ask about controls that prevent losses rather than ones that sound thorough. A carrier asking the wrong questions would not stay solvent.
So our advice is genuinely this: if you do nothing else on security this year, make every answer on your application true and provable. That is better prioritized than most frameworks, it fits on one page, and you already have to fill it out. It lines up with the broader case for treating security as a business function rather than an IT chore.
Controls are only half of it. The Federal Trade Commission advises small businesses to discuss with their insurance agent what policy best fits the company’s needs, including whether to go with first-party coverage, third-party coverage, or both, and to check whether the insurer will defend you in a lawsuit or regulatory investigation by looking for duty to defend wording. Good controls plus the wrong coverage design still leaves you exposed.
The Bottom Line
Treat your cyber insurance application as a live document rather than annual paperwork. Answer it from evidence, keep that evidence somewhere safe, and check it once a year before renewal. That habit costs a morning and removes the most common way businesses find a problem at the worst possible moment.
One more time, because it matters: this is general information only. We are an IT company, not an insurance advisor or a law firm. Policy language, state law, and your circumstances decide everything that counts, and your broker or carrier is the right person to confirm it.
What we can do is the technical half. If you want help pulling real coverage reports, documenting backup tests, and building an evidence folder you can hand a broker without flinching, that is ordinary work for us. We do it for small and mid-sized businesses across Denton County, well ahead of renewal so there is time to fix what turns up. Contact us today.
Sources:
Comments are closed