Cyber Insurance: The IT Checklist Insurers Ask For

Most cyber insurance applications now include a real security questionnaire, and a claim can be denied if a control you attested to wasn’t actually in place. This guide walks through the IT controls insurers commonly ask about, grounded in CISA’s Cyber Essentials framework.

Why this matters before you apply

A gap here can cost you the policy, or the claim.

Insurers ask before they’ll write it — Most applications now go through a real security questionnaire.

A claim can be denied, too — If a control you attested to wasn’t actually in place when the loss happened.

It’s mostly just good security — Nearly everything on the list is worth doing anyway.

The cyber insurance IT checklist, step by step

The big three

1-3The big three

Multifactor authentication, tested backups, and security awareness training for your team.

WHAT TO DOWe’ve covered MFA and ransomware-proof backups in their own videos; links are in this guide.

Cyber insurance checklist: The big three

Incident response

✓A written, tested incident response plan

Who does what, who you call, and how you keep the business running while it’s handled.

WHAT TO DOA plan nobody’s ever tested is just a document. Run through it at least once a year.

A written, tested incident response plan

Naples Computers

★Ready for your cyber insurance application?

We’ll check your setup against the checklist, close the gaps, and document what’s actually in place.

WHAT TO DOCall 239-513-1960, especially before your next application or renewal.

Ready for your cyber insurance application?

What else they look for

Automatic updates — For every operating system, and the software running on top of it
Endpoint protection — Modern malware protection on every device, not just basic antivirus
Least-privilege access — Nobody has admin rights they don’t actually need for their job

Proof matters more than a checkbox

Keep records that controls are enforced — Not just that a policy exists, that it’s actually turned on
Don’t overstate the application — An inaccurate answer can void coverage exactly when you need it most
Review it before every renewal — Requirements change as insurers see more claims

Recap: the cyber insurance checklist

MFA, tested backups, and security awareness training come up first
Automatic updates, endpoint protection, and least-privilege access
A written, tested incident response plan
Proof matters more than a checkbox, don’t overstate the application
Ready for your application? Call Naples Computers

Printable quick guide

The Cyber Insurance IT Checklist (1-page quick guide PDF)

Frequently asked questions

What IT controls do cyber insurers usually ask about?

Commonly: multifactor authentication (especially for admin and remote access), regularly tested backups, security awareness training for staff, automatic software updates, endpoint malware protection, least-privilege access, and a written, tested incident response plan.

Can a cyber insurance claim be denied even if I have a policy?

Yes, if a control you attested to on the application wasn’t actually in place or enforced when the loss occurred. Insurers increasingly expect evidence that controls were actually enforced, not just a checked box.

Is there an official government cyber insurance checklist?

Not a single official one; requirements vary by insurance carrier. CISA’s Cyber Essentials framework covers the same categories of controls insurers commonly ask about, and is a solid baseline to work from.

How often should I review my cyber insurance readiness?

Before every application or renewal, since requirements change as insurers see more claims. It’s also worth testing your incident response plan at least once a year, not just keeping it as an unused document.

Related guides

Source: Cyber Essentials (CISA)

Proof matters more than a checkbox. Keep records showing each control was actually enforced, not just that a policy exists on paper, and review your answers before every renewal.