Cyber insurance requirements: what insurers now ask for

A few years ago, buying cyber insurance meant filling in a short form. Today the application reads more like a security audit. Insurers have learned which controls reduce losses, and they increasingly expect to see them in place before they will offer cover or renew it. This guide explains the most common cyber insurance requirements, how to answer the application accurately and how to prepare before your next renewal.

Why insurers ask more than they used to

Claims for ransomware, email fraud and data breaches have pushed insurers to look closely at how well each business is protected. The questions on the application are, in effect, a list of the controls that most often make the difference between a near miss and a costly claim.

Common cyber insurance requirements

Requirements vary between insurers and policies, but these topics appear on most applications:

Control	What insurers want to know
Multi-factor sign-in	Is it required for email, remote access and administrator accounts?
Backups	Are they kept separate from your main systems, and have you tested restoring them?
Email security	Is your domain protected, and is incoming email filtered for threats?
Updates	Are security updates applied promptly across your systems?
Administrator access	Are privileged accounts limited and protected?
Staff awareness	Do your people receive training on phishing and fraud?
Incident planning	Do you know who to call and what to do if something happens?
Monitoring	Are your systems watched for suspicious activity, and would someone notice an attack in progress?
Third-party access	How do vendors and remote users connect, and is that access limited and protected?

An application is not a formality. If you tick yes to a control that is not really in place, it can complicate a claim when you need it most.

// INSIGHTS BY EMAIL

Get AMDigitec Insights by email

Email address

Subscribe

Privacy policy

How to answer a cyber insurance application

The cyber insurance application, sometimes called a security questionnaire, is more than paperwork. It is a signed statement about how your firm is protected, and insurers rely on it when they price your policy and when they assess a claim.

• Read the exact wording. “Multi-factor sign-in is required for all users” is not the same as “for most users”. If one account is an exception, say so.
• Involve the right people. The person who handles renewals is often not the person who knows how backups and sign-in are set up. Answer together.
• Answer from evidence, not memory. If you believe a control is in place, confirm it before you tick the box.
• Note what is in progress. If a control is planned but not yet complete, describe it accurately, with a date.

Taking an extra week to answer accurately is far better than discovering a gap after an incident.

How to prepare before renewal

• Read the questions early. Many renewals arrive with little notice; give yourself time.
• Check, don’t assume. Confirm each control is genuinely in place, not just planned.
• Keep evidence. Simple records, such as when a backup restore was last tested, make answers easy to support.
• Close the gaps that matter most first. Multi-factor sign-in and tested backups are usually the priorities.
• Ask about anything unclear. Your broker can explain what a question means for your policy.
• Bring your IT provider and broker together. A short conversation before the form is due avoids guesswork on both sides.

Insurance and security work together. Insurance helps you recover from an incident; the controls insurers ask about help prevent one in the first place.

Cyber insurance for law firms and accounting firms

Professional firms face the same core requirements as any business, but a few areas tend to get closer attention.

• Payment and wire fraud. Firms that move client funds are frequent targets of fake payment instructions. Insurers often ask how payment changes are verified, and cover for this kind of loss is not always included by default. Ask your broker exactly what your policy covers.
• Client confidentiality. Legal and financial records are highly sensitive, so expect questions about who can access client files and how they are shared.
• Email security. Most fraud against professional firms starts with email, so domain protection and staff awareness carry real weight.

We cover these risks in more depth for law firms and accounting firms, including how closing-fund fraud works.

What happens if you make a claim

Most firms think about the application once a year and forget it until renewal. It matters most on the day something goes wrong.

When you report an incident, the insurer will usually want to understand how it happened and whether the controls you described were in place at the time. A claim tends to go more smoothly when you can show:

• What you declared. A copy of the application you signed, so everyone is working from the same answers.
• Evidence the controls were working. Sign-in settings, backup records and training records from before the incident, not reconstructed afterwards.
• A clear timeline. When the problem was noticed, who was contacted and what was done in the first hours.
• Early contact. Most policies expect prompt notice, and many insurers provide incident response help that is only available if you call them first.

Keep your policy details and the insurer’s incident contact somewhere you can reach even if your own systems are down. Your broker can confirm exactly what your policy expects when an incident is reported.

Getting a clear picture

If you are not sure how your firm would answer these questions, an IT & Security Assessment verifies which controls are actually in place, ranks the gaps by business impact and gives you a written plan, which also makes the next insurance application much easier to complete. To close the gaps that matter, see our cybersecurity services.

Common questions

What is the most common cyber insurance requirement?

Multi-factor sign-in. It appears on almost every application, usually for email, remote access and administrator accounts, because it stops a large share of account takeovers.

Do all insurers ask the same questions?

No. The topics overlap a great deal, but each insurer and policy has its own requirements. Always read the application you receive.

Does cyber insurance cover wire fraud?

It depends on the policy. Losses from fake payment instructions are often handled under a separate part of cover, sometimes with lower limits or extra conditions. Your broker can confirm exactly what your policy includes.

Can our IT provider fill in the application for us?

Your IT provider can help you answer accurately and gather the evidence behind each answer. The application is still your firm’s statement, so a responsible person should review and sign it.

What if we cannot meet every requirement before renewal?

Be accurate about where you stand and talk to your broker. Showing a clear plan to close the gaps is better than an inaccurate answer.