Cyber insurance preparation
Know what is in place before you check the box.
Cyber insurance applications commonly ask about the protections around your accounts, computers, and data. This checklist helps you prepare, but insurers' questions vary. Start with your actual application and ask your insurer or agent to clarify anything unclear.
Common application topics
Eight areas to review and document.
Answer based on what is in place today, not what you intend to add. If a protection only covers some accounts or devices, make that scope clear rather than guessing at a yes or no.
1. Multi-factor sign-in
Which accounts require a second step beyond a password, including email, remote access, and administrator accounts?
Keep a record of where multi-factor authentication is enforced and any exceptions.
2. Backups, including offsite or immutable copies
What data is backed up, where are copies stored, and are copies protected from changes or deletion? How is recovery tested?
Document the backup scope, offsite storage, any immutability settings, and recovery test results. Offsite and immutable describe different protections.
3. Endpoint protection and EDR
Which computers have protection, and is endpoint detection and response (EDR) in place to help detect and respond to suspicious activity?
Record the tools in use, the devices covered, and who reviews alerts. Do not assume basic antivirus is the same as EDR.
4. Security awareness training
Do staff receive guidance on phishing, suspicious requests, and reporting concerns?
Keep training materials and completion records so the answer reflects who has actually received training.
5. Patching
How are operating system and application security updates applied and tracked?
Document the update process, device status, and how missed updates or exceptions are handled.
6. Email filtering
What protection is in place against malicious messages, attachments, and links?
Record the email filtering tools, settings, and accounts covered.
7. Admin account control
Who has administrator access, and is it limited to people who need it? Are separate admin accounts used?
Maintain an access list and document how privileges are reviewed and removed when someone leaves.
8. An incident response plan
Is there a written plan for what to do and whom to contact if an account is stolen or systems are affected?
Keep a current plan with responsibilities, contact details, and recovery steps. Check your policy for incident reporting instructions.
How BBComputing helps
Put the protections behind the answers.
We help clients review the insurer's technical questions against their current setup, identify gaps, and put the needed protections in place. That includes sign-in security, device protection, backups, updates, email filtering, access controls, staff guidance, and incident planning.
We help document settings, covered devices and accounts, training, and recovery plans so you have records to support your answers. As systems and staff change, we help keep those protections and records current.
Technical help, not a coverage promise.
This checklist is preparation guidance, not a complete statement of any insurer's requirements. BBComputing does not guarantee coverage or claim outcomes. Your insurer or insurance agent should answer questions about policy terms and whether a particular protection meets their requirements.
Questions
Cyber insurance checklist questions
Does every insurer ask the same questions?
No. Insurers' questions vary. Use your insurer's actual application and policy requirements rather than treating a general checklist as a complete list.
Can BBComputing help with our application?
Yes. We help clients review the technical questions, put protections in place, and document what is in place so application answers reflect the actual setup.
Does completing this checklist guarantee coverage or a paid claim?
No. BBComputing does not guarantee coverage or claim outcomes. Questions about coverage and policy terms should go to your insurer or insurance agent.
What backup details might an application ask about?
Applications commonly ask about backups, including whether copies are offsite or immutable. Immutable backups are designed to prevent changes or deletion for a set period. Check the specific wording on your application.