Answer from memory, sign, file it
The form gets completed from what everyone believes to be true, because there is a deadline and the questions look answerable. The gap between belief and evidence is discovered by a loss adjuster.
The application is a warranty, not a survey.
Answering wrong is worse than answering no.
A cyber insurance application asks you to state that specific controls are in place: multi-factor authentication everywhere, tested backups, an incident response plan, endpoint protection across the estate. Those answers become warranties in the policy. A control you believed you had and did not is the ground on which a claim gets declined, at exactly the moment you need it to be paid. Almost nobody has the evidence to answer these questions properly, and almost everybody answers them anyway.
Underneath
What is actually going on
The visible problem is rarely the one that decides how this goes. These are the parts that are true whether or not anybody has said them out loud.
The questions have precise meanings
"Is MFA enforced on all remote access and all privileged accounts" is not a question about whether MFA is switched on. Service accounts, break-glass accounts and legacy protocols are where the honest answer usually changes.
Nobody has the evidence
The application asks for facts about the estate that exist only as the difference between two exports nobody has ever put side by side.
The person signing did not gather the answers
An executive signs a warranty assembled from what the IT team believed and the provider reported. Neither of them is the one whose signature is on it.
A wrong answer survives the renewal
The application is not a one-day document. It sits inside the policy for the whole term, and it is read closely exactly once: when you claim.
The fork
Two ways this usually goes
Answer from evidence, and disclose what you cannot evidence
Produce the exports, count the exceptions, close what is closeable in the time available, and answer the rest accurately. An honest no is insurable. A warranted yes that is not true is not.
The order
What to do, in sequence
The order matters more than the individual steps. Most of the cost in these situations comes from doing the right things in the wrong sequence.
- First
Read the questions before answering any
Establish exactly what is being warranted, including the definitions. Several answers change once the wording is read carefully.
- Then
Produce the evidence
Directory, sign-in, endpoint, backup and patch exports, read against each other. This is the part that turns beliefs into counts, and it is the work our assessment does anyway.
- Then
Close what is closeable
Most gaps found at this stage are exceptions rather than absences: a handful of accounts, one legacy protocol, one server. Sixty days is usually enough.
- Finally
Answer accurately, with the caveats stated
Including the ones that are still open, described precisely. Underwriters price known exceptions; they decline undisclosed ones.
The questions
What you will be asked
Each of these has a real answer and a plausible one. Knowing which you are giving is most of the job.
Is a second factor registered on every account, including service and administrative accounts?
When was a restore last actually performed, and by whom?
Does endpoint protection cover every machine, or every machine we know about?
Has anybody read the incident response plan this year?
The result
What you end up with
- Evidenced answers to every question the application asks
- A remediation list ordered by what is closeable before the deadline
- A defensible application, with exceptions disclosed rather than hidden
- The same evidence, reusable for customer security questionnaires
Also happening