Guide · Owners, CFOs, and insurance brokers
Is your cyber insurance application true?
The insurer reads your application again after a claim. Before you sign the renewal, check every "yes" against what's really turned on, starting with multi-factor sign-in, backups, and monitoring.
A cyber insurance application looks like paperwork. It isn’t. It’s part of the deal you make with the insurer, and after a claim, the insurer reads it again and compares your answers with what its investigators find.
In 2022, Travelers went to court to cancel a policy after a ransomware attack at a company called International Control Services. Travelers said the application overstated how the company used multi-factor sign-in (MFA, a code or prompt on your phone when you log in). After the attack, it found MFA protected the firewall and nothing else. The company agreed to let the court cancel the policy.
Most applications aren’t filled out by someone trying to mislead anyone. They’re filled out in a hurry by whoever had the form last: the IT company, the office manager, the controller. The question asks about all remote access. The answer describes email.
The questions that cause the most trouble
Wording changes by insurer and by year, but these show up on most applications for small and mid-size businesses.
MFA for email. The real question is whether someone with a stolen password can get into any mailbox. Check shared mailboxes, old accounts, and the owner’s own account. Ask whether the older sign-in methods that skip MFA are turned off.
MFA for remote access. This covers the VPN (the way staff connect to the office network from outside), remote desktop, the remote support tool your IT company uses, and any vendor that connects in. It’s common for email to have MFA while the VPN doesn’t, and remote access is one of the most common ways ransomware gets in.
Admin accounts. Who can change settings on email, servers, the firewall, the backups, and the accounting system? Each person should have their own admin sign-in, protected with MFA. Watch for shared admin logins and accounts for people who left.
Backups. Could an attacker who has your admin password delete the backups too? Is there a copy that’s offline, or locked so nobody can change it for a set time? When did someone last restore a whole system, not just check that the backup job said “success”?
Monitoring. Some applications ask whether someone watches security alerts around the clock. Ask your IT company one question: who sees the alert at 2 a.m. on a Saturday, and what are they allowed to do about it? If the answer is an inbox, you don’t have 24-hour monitoring.
Payment verification. Do you confirm a change to a vendor’s bank details by calling a number you already had? This one belongs to finance, not IT, which is why it gets missed. See what to do after a near-miss on a fake vendor payment.
How to check your answers
- Get last year’s application as it was submitted, and this year’s form from your broker.
- Next to each “yes,” write down the proof: a report, a screenshot, or an export, with a date on it. “We have that” isn’t proof.
- Ask your IT company for that proof in writing. A good one can pull most of it within a week.
- Where the honest answer is “partly,” talk to your broker before you sign.
- Make a short list of what to fix, with one owner and one date for each item.
What to fix first
Start with MFA on every way into your network from outside, then the backups. A competent IT company can usually close both quickly, and both appear on nearly every application. Then write down your payment verification rule and practice it. That one costs nothing but an afternoon.
If you’re an insurance broker: this page is written to forward. Send it to a client a month before renewal, while there’s still time to fix what it turns up.
Sources: Lockton on Travelers v. International Control Services.
Questions
Who should fill out the cyber insurance application?
The person who signs it, usually the owner or an officer, owns the answers. Your IT company or IT person supplies the facts. Someone who understands both should check that each answer matches what the question actually asks.
What if the honest answer is no?
Say no, and give the date it becomes yes. Your broker can work with an honest no and a dated plan. A yes that isn't true can turn a covered claim into a dispute.
What if last year's application was wrong?
Tell your broker before you sign the renewal, and let them advise you on how to correct it. They would much rather hear it from you now than from an investigator after a claim. If it raises a legal question, ask your attorney.
Do you sell insurance or fill out the application for us?
No. Your broker places the policy and you sign the application. We check the answers against what's really in place and give you a to-do list and a file your broker can use.
Related guides
Where Northcreek fits
Cyber Insurance Readiness (cyber insurance application and MFA review). Make your cyber insurance application true. You get a to-do list your team can finish and a clean file for your broker.