Most cyber insurance applications now include a real security questionnaire, and a claim can be denied if a control you attested to wasn’t actually in place. This guide walks through the IT controls insurers commonly ask about, grounded in CISA’s Cyber Essentials framework.
Why this matters before you apply
A gap here can cost you the policy, or the claim.
The cyber insurance IT checklist, step by step
1-3The big three
Multifactor authentication, tested backups, and security awareness training for your team.
✓A written, tested incident response plan
Who does what, who you call, and how you keep the business running while it’s handled.
★Ready for your cyber insurance application?
We’ll check your setup against the checklist, close the gaps, and document what’s actually in place.
What else they look for
- Automatic updates — For every operating system, and the software running on top of it
- Endpoint protection — Modern malware protection on every device, not just basic antivirus
- Least-privilege access — Nobody has admin rights they don’t actually need for their job
Proof matters more than a checkbox
- Keep records that controls are enforced — Not just that a policy exists, that it’s actually turned on
- Don’t overstate the application — An inaccurate answer can void coverage exactly when you need it most
- Review it before every renewal — Requirements change as insurers see more claims
Recap: the cyber insurance checklist
- MFA, tested backups, and security awareness training come up first
- Automatic updates, endpoint protection, and least-privilege access
- A written, tested incident response plan
- Proof matters more than a checkbox, don’t overstate the application
- Ready for your application? Call Naples Computers
Printable quick guide
Frequently asked questions
What IT controls do cyber insurers usually ask about?
Commonly: multifactor authentication (especially for admin and remote access), regularly tested backups, security awareness training for staff, automatic software updates, endpoint malware protection, least-privilege access, and a written, tested incident response plan.
Can a cyber insurance claim be denied even if I have a policy?
Yes, if a control you attested to on the application wasn’t actually in place or enforced when the loss occurred. Insurers increasingly expect evidence that controls were actually enforced, not just a checked box.
Is there an official government cyber insurance checklist?
Not a single official one; requirements vary by insurance carrier. CISA’s Cyber Essentials framework covers the same categories of controls insurers commonly ask about, and is a solid baseline to work from.
How often should I review my cyber insurance readiness?
Before every application or renewal, since requirements change as insurers see more claims. It’s also worth testing your incident response plan at least once a year, not just keeping it as an unused document.
Related guides
- Turn On MFA for Your Whole Microsoft 365 Company
- Backups for Business: What Ransomware-Proof Really Means
- Email Security Explained: SPF, DKIM, DMARC in Plain English
Source: Cyber Essentials (CISA)