What cyber insurers really ask for

A practical overview of controls commonly addressed in cyber-insurance questionnaires, including MFA, backups, patching and incident readiness. Requirements vary by insurer and policy.

Cyber insurance underwriting has tightened. Questionnaires commonly ask about MFA, backups, patching, endpoint protection, privileged access and incident response — though the exact requirements vary between insurers, policies and organisations. Getting the basics in place and documented gives you evidence to answer them confidently. CyberByte does not provide insurance or financial advice.

Controls commonly addressed by questionnaires

• MFA everywhere — especially email, remote access (VPN/RDP) and all administrative accounts.
• Endpoint detection and response (EDR) across devices, not just traditional antivirus.
• Tested, offline or immutable backups you can actually restore from.
• Email filtering and phishing protection.
• A regular patching cadence and no unsupported, end-of-life systems exposed.
• An incident response plan that has actually been rehearsed.
• Often, an Essential Eight maturity level used as shorthand for the above.

How to evidence it at renewal

The organisations that renew well treat the questionnaire as a year-round program with a clear owner, not a scramble the week before. They keep the evidence current — configuration screenshots, policy documents, backup-restore test results — so when the renewal lands, the answers are already true and provable. That's also exactly the evidence that holds up if you ever need to make a claim.