Cyber insurance used to be a footnote on a business policy. Now it is a renewal line item that can jump, get declined, or arrive with conditions attached — and what decides your terms is rarely how much you spend. It is whether you can demonstrate the controls the insurer asks about. This is what they actually check, and what it takes to pass.
Why Underwriters Got Strict
A ransomware claim is expensive: downtime, forensics, legal, notification, negotiation. Insurers absorbed a wave of them through 2021 and 2022 and then changed how they write the product. Prices rose, limits tightened, and the application turned from a form into a questionnaire.
The shift is not really about risk appetite. It is about evidence. An insurer cannot see your business, so it asks for proof that the things which reliably prevent or contain a breach are in place. Where you can prove it, you get better terms. Where you cannot, you pay more or get declined.
The thing most owners miss: the questionnaire is not a formality to fill in quickly. Your answers become the basis of the contract. If you say you enforce MFA and a claim later shows you did not, that is a misrepresentation, and it can void the cover.
The Six Things They Actually Check
Every questionnaire differs, but the same handful of controls recur across carriers. Almost all of them map to one of these six.
1. Multi-Factor Authentication
This is the most heavily weighted question on most applications, and for good reason: credential theft is the most common way into a business, and MFA is the cheapest control that stops it.
What they mean is not "MFA exists somewhere." They mean it is enforced on:
Email — the account everything else resets through.
Remote access — VPN, RDP, anything reachable from outside.
Administrative accounts — domain, MDM, cloud consoles, finance systems.
Legacy protocols are where this falls down. If your mail still accepts basic authentication for older clients, MFA is bypassable in practice even though the setting says it is on. Underwriters increasingly ask about exactly this.
2. Patching and Vulnerability Management
They ask how quickly critical patches are applied, and whether you have a defined window. The answer they want is a policy, not a story about doing updates when someone remembers.
A stated cadence — critical patches within days, not "monthly-ish."
Coverage you can show — which devices, and how many are actually current.
Something that measures it — a report you could hand over.
This is where Apple fleets often struggle to answer, not because patching is hard but because nobody has the export. Device management solves it: compliance and OS version become a query, not a guess.
3. Backup and Recovery
Insurers increasingly distinguish between having backups and having tested, isolated backups. Ransomware operators target backup systems specifically, so a backup reachable from a compromised machine is not a control — it is a second victim.
What you need to be able to say:
Backups run on a schedule you can evidence.
At least one copy is offline or immutable.
A restore has been tested, with a date you can point to.
The third item is the one businesses most often cannot answer. An untested backup is a belief, and auditors and underwriters both treat it that way.
4. Endpoint Protection
They want to know that every device has endpoint protection, that it is centrally managed, and that you can tell whether it is running. A licence count is not the same as a coverage number.
On macOS this is where device management earns its keep: MDM reports which machines have the agent installed and healthy, versus which are assumed to.
5. Access Control and Offboarding
The questions here are about least privilege and the departed. Can a former employee still get in? Do contractors have standing access to systems they touched once?
Named accounts — no shared logins, because a shared login has no accountability and cannot be revoked cleanly.
Leavers process — a documented, repeatable offboarding step, not an email asking someone to remember.
Reviews — periodic checks that access still matches the role.
6. Incident Response
Insurers want to know what happens in the first hour. Not the full runbook — just whether anyone has thought about it.
Who you call, and whether that person knows they are the one to call.
How you would isolate a compromised machine.
Whether the plan is documented anywhere other than in someone's head.
Your insurer will also tell you who to call during a claim. That is not a substitute for your own first hour.
What Passing Looks Like
Passing is not about buying your way into better terms. It is about answering each question with something concrete, and having the answers agree with each other.
The practical shortcut: most of these controls are the same ones that make a fleet manageable. MFA, patching, encryption, endpoint coverage and offboarding are not insurance paperwork — they are the operating baseline. If they are genuinely in place, the questionnaire is a matter of exporting proof. If they are not, the questionnaire is where you find out.
Two things worth doing before renewal:
Answer it with evidence in hand. Where you cannot prove a control, do not claim it. A weaker true answer beats a stronger false one that voids the policy.
Start early. Remediation takes weeks. Finding a gap the week before renewal turns a fix into a negotiation.
Where We Come In
Compliance work is mostly the discipline of turning good intentions into controls you can evidence. We do gap analysis against the frameworks underwriters reference, then implement the technical side — enforced MFA and FileVault, patch compliance reporting, tested backups, endpoint coverage, and access reviews that survive an audit.
If a renewal is coming and the questionnaire is sitting in your inbox, it is a reasonable moment to find out where you stand: book a free IT assessment and we will work through what you can and cannot prove today.
