What Cyber Insurance Is Actually Asking For

Cyber insurance has evolved

Cyber insurance questionnaires have changed significantly over recent years.

Insurers are no longer focused on whether security tools simply exist. They are focused on how cyber risk is managed in practice, and whether controls are applied consistently and can be demonstrated.

For many businesses, this shift only becomes obvious at renewal time — or worse, after an incident.

From checklists to security maturity

Where insurers once asked questions such as "Do you have antivirus?" and "Do you use a firewall?", they now focus on areas such as:

Identity and access management
MFA enforcement
Backup testing
Incident detection
Governance and documentation

These questions reflect real-world loss patterns, not theoretical best practice.

Where businesses are often exposed

Backups exist but have never been tested
MFA is enabled for some users but not all
Access controls are assumed rather than reviewed
Security settings were configured once and forgotten

When a claim arises, these assumptions can quickly become liabilities.

Evidence now matters

Insurers increasingly expect:

Clearly defined baselines
Proof of implementation
Documentation that reflects reality
Ongoing review and monitoring

This is why governance and advisory work are now just as important as technical controls.

Insurance is no longer about what you've bought — it's about how you operate.

Preparing before renewal

A structured review, such as a Cyber Snapshot cyber security assessment, helps businesses:

Answer insurance questions accurately
Identify gaps before renewal
Prioritise improvements that reduce risk

Cyber insurance shouldn't be the first time security is assessed — but for many businesses, it is.

Final thought

Cyber insurance doesn't reward assumptions. It rewards clarity, evidence, and consistency.

Businesses that understand their risk and govern it deliberately are better positioned — both to obtain coverage and to respond effectively when incidents occur.