What cyber insurers really ask for

A practical overview of controls commonly addressed in cyber-insurance questionnaires, including MFA, backups, patching and incident readiness. Requirements vary by insurer and policy.

Cyber insurance questionnaires commonly ask about MFA, backups, patching, endpoint protection, privileged access and incident response — though the exact requirements vary between insurers, policies and organisations. Getting the basics in place and documented gives you evidence to answer them confidently. CyberByte Security does not provide insurance or financial advice.

Controls commonly addressed by questionnaires

• MFA everywhere — especially email, remote access (VPN/RDP) and all administrative accounts.
• Endpoint detection and response (EDR) across devices, not just traditional antivirus.
• Tested, offline or immutable backups you can actually restore from.
• Email filtering and phishing protection.
• A regular patching cadence and no unsupported, end-of-life systems exposed.
• An incident response plan that has actually been rehearsed.
• Often, an Essential Eight maturity level used as shorthand for the above.

How to evidence it at renewal

A practical approach is to treat the questionnaire as a year-round programme with a clear owner, not a scramble the week before. Keep the evidence current — configuration screenshots, policy documents, backup-restore test results — so when the renewal lands, the answers are already accurate and supported. Keeping this evidence current may also help if you ever need to demonstrate your controls to your insurer.