Getting ready for a cyber insurance application: the controls you’ll be asked about

This guide is for security teams, IT leaders and finance directors preparing a cyber insurance application or renewal. It sets out the areas of control that applications commonly cover, what good evidence looks like, and how to make sure the answers you give reflect reality across the whole organisation.

Question sets differ between insurers and change over time, and every policy has its own wording and conditions. Treat this guide as preparation, not a substitute for the questions you actually receive. An authorised broker or insurer is who explains what a specific policy requires and how it applies to you.

#Why do insurers ask so many questions about security controls?

Insurers ask about security controls because those controls affect how likely an incident is and how severe it could become. Your answers help them decide whether to offer cover and on what terms. The NCSC advises giving accurate information, because claiming measures that are not in place may mean the insurer is not obliged to pay.

The NCSC's cyber insurance guidance notes that applications may ask for details of technical, procedural and human controls, and that policies are typically reassessed every year. It advises telling insurers when your circumstances change. It also encourages organisations not to limit themselves to an insurer's minimum requirements, but to build defences around their own critical assets and worst-case scenarios.

A useful discipline is that every 'yes' should be backed by evidence you could show a third party. If the honest answer is 'mostly' or 'in progress', say so and explain the plan and timescale. A broker can help you present an accurate picture.

#Which identity and access controls will you be asked about?

Expect questions on multi-factor authentication for email, remote access, cloud services and administrator accounts, and on how privileged access is controlled. Insurers want to know whether a stolen password alone could give an attacker a way in. Be ready to say where MFA is enforced, which methods are used and where any exceptions remain.

Identity is a natural focus because account takeover gives attackers a route into email and cloud services. The Cyber Essentials Requirements for IT Infrastructure v3.3, dated April 2026, state that authentication to cloud services must always use MFA, which gives a useful baseline to measure yourself against.

Not all MFA is equal. The NCSC's guidance on recommended types of MFA describes FIDO2 as one of the most secure, yet usable, methods, offering resistance to guessing, phishing and theft. It says message-based methods, such as codes sent by SMS, are only likely to be appropriate when no other strengthening method is possible.

#Identity evidence to gather

• A list of systems where MFA is enforced: email, remote access, cloud platforms, finance systems and administrator consoles.
• The MFA methods in use, and any users or accounts exempt from MFA, with the reason and planned fix.
• How administrator accounts are kept separate from everyday user accounts.
• How privileged access is granted, reviewed and removed, including access held by suppliers.
• How leavers' accounts are disabled, and how quickly this happens.
• How service accounts and shared accounts are controlled and monitored.

#What will you be asked about backups and recovery?

Expect questions on how often you back up, whether backups are separated from your main network, whether an attacker could alter or delete them, and when you last tested a restore. Insurers want confidence that you could recover critical systems without relying on criminals. Tested, well-protected backups are central to that confidence.

The NCSC's ransomware-resistant backups principles note that attackers often target backups and backup infrastructure, deleting or destroying the data stored there. They also stress that a backup solution is only effective in practice if system owners regularly test and monitor the health of the backup data.

The NCSC's guidance on mitigating malware and ransomware attacks adds practical steps: keep offline backups separate from your network, use more than one backup solution and location, scan backups for malware before restoring, regularly test that restores work, and protect backup accounts with MFA.

#Backup evidence to gather

• Which systems and data are backed up, how often, and where the copies are held.
• Whether at least one copy is offline, separated, or protected against alteration and deletion.
• Who can access backup systems, and whether that access uses MFA and separate credentials.
• The date and result of the last restore test for each critical system, and how long the restore took.
• Your documented recovery order for critical services.

#What about patching, endpoints and email security?

Applications commonly ask how quickly you apply security updates, whether unsupported software remains in use, what protection runs on laptops and servers, and how email is filtered. Be ready to explain your patching timescales, how you find weaknesses in internet-facing systems and how you manage any systems that cannot be updated.

Cyber Essentials v3.3 gives a clear reference point. It requires updates that fix critical or high-risk vulnerabilities to be applied within 14 days of release, and requires software to be licensed and supported, with unsupported software removed from devices or from scope. If you already meet these requirements, say so and have the evidence ready.

• Patching: your target timescales, how you measure performance against them and how exceptions are approved.
• Unsupported systems: a list of any end-of-life software or devices, why they remain and how they are isolated.
• Internet-facing systems: how you find and fix weaknesses in remote access gateways, firewalls and public services.
• Endpoint protection: the tools on laptops, desktops and servers, and who responds to alerts, including out of hours.
• Email: filtering, protection against spoofing of your domains and how staff report suspicious messages.

#Which process and people controls matter?

Applications may also ask about incident response planning, staff awareness, payment verification and supplier management. Insurers want to see that people know what to do and that key processes would hold under pressure. A tested incident response plan and a clear process for verifying changes to payment details are typical areas to prepare for.

• An incident response plan, who owns it and when it was last exercised.
• Your insurer's incident line, if you have cover, stored where staff can find it during an outage.
• Security awareness activity for staff, including how they report suspicious emails.
• A documented process for verifying new or changed supplier bank details through a second channel.
• How you assess and monitor suppliers that hold your data or connect to your systems.
• Logging and monitoring: what is collected, how long it is kept and who reviews it.

#How do you make sure your answers are accurate?

Make your answers accurate by giving each question an owner, checking it against evidence rather than memory, and covering every part of the organisation in scope, including subsidiaries and acquired businesses. Flag partial answers honestly and explain your plans. Before signing, have a senior person review the responses with the security team.

1. Get the question set early from your broker and share it with IT, security, finance and legal.
2. Assign one owner per question and agree a deadline for evidence.
3. Check each answer against system reports or configuration, not assumption.
4. Confirm the scope: every entity, site and cloud service the policy is meant to cover.
5. Record where answers are partial, with remediation dates.
6. Keep a copy of the submitted answers and the evidence pack for renewal and for any claim.
7. Tell your broker or insurer if something material changes during the policy period.

#What to do next

Start by requesting the question set from your broker or insurer, then run a short internal review of identity, backups, patching and response planning against real evidence. Fix quick wins before you submit. Business Cyber Check can introduce your organisation to up to 3 authorised insurers or brokers who can explain specific policies.

If you find gaps, prioritise those that would let a single stolen password or a single failed backup turn a contained incident into a crisis. Multi-factor authentication on email, remote access and administrator accounts, and tested backups that an attacker cannot easily reach, are sensible places to begin.

Policies differ, and the wording decides what is covered and which conditions apply. Business Cyber Check does not quote, advise on or recommend policies. We introduce organisations to up to 3 authorised insurers or brokers, who can explain a specific policy and its requirements.

#Frequently asked questions