Cyber insurance application checklist: evidence to gather
Complete a cyber application from current evidence, not an ideal description of your security program. Assign each question to someone who knows the control, record its scope and exceptions, and clearly distinguish current practice from planned improvements.
- Current facts, not aspirations
- Scope and exceptions
- Evidence behind each answer
Assign an owner to each group of questions
| Question area | Useful evidence | Who can confirm it |
|---|---|---|
| Identity and MFA | Settings, enrolled accounts and exceptions | IT or identity administrator. |
| Backups and recovery | Backup scope, isolation and recent restore results | Infrastructure or recovery owner. |
| Endpoint protection and patching | Device coverage, monitoring and update process | Security/IT operations. |
| Data and service providers | Data inventory, access map and major vendors | Security, engineering and operations. |
| Incidents and claims | Dates, impact, response and prior notices | People responsible for incident and claims records. |
Answer the actual scope of the question
A control can exist in one environment and be absent in another. Check whether the question concerns all users, privileged users, remote access, email or a specific business system.
If the application permits explanation, record exceptions and dates. If its yes/no format does not fit the facts, resolve that wording before signing rather than choosing the most favorable answer.
MFA is enabled, but not everywhere
Hypothetical example · illustrates a distinction, not a coverage decision
Hypothetical example: employees use MFA for email, but two legacy administrator accounts do not require it. A question about MFA on all privileged access is not answered by the email setting.
Identify the accounts, the exception and any planned remediation separately. A future deployment date is not evidence that the control exists today.
Gather the packet before completing the application
Use this list as you prepare. Checks stay on this page and are not submitted.
Keep a copy and track material changes
Review the completed answers with the people who supplied them. Retain the signed application and supporting evidence so future renewals start from an accurate record.
CISA’s performance goals provide security guidance, not an insurer’s universal eligibility checklist. Underwriting also considers activities, exposure, claims, limits and the insurer’s own criteria; no individual control guarantees a quote or premium.
Common questions
Can planned controls be listed as implemented?
No. Identify the planned change and date separately from current practice. Application answers should match the facts at the time requested.
Does checking all the boxes guarantee coverage?
No. The insurer evaluates the submission and offers terms if it chooses. The issued policy and endorsements determine coverage, not completion of a checklist alone.
Sources and further reading
Policy terms vary. These primary references explain the distinctions above; carrier examples describe their own products.
- FTC: Cyber insurance ↗Own incident costs and liability to others.
- CISA: Cybersecurity performance goals ↗Security guidance, not an insurer eligibility checklist.
Put the details to work.
Use the related explanations, or start a quote with your business information and requirements.
Get a quote