The Questionnaire Your Insurer Sends Is Secretly an IT To-Do List

Every year the cyber insurance questionnaire gets a bit longer. A few years ago it was three pages and a signature. Now it asks whether MFA covers all remote access, whether backups are immutable, whether you test restores, and who exactly picks up the phone at 2am.

Most small business owners read it, feel mildly accused, and either guess or forward it to whoever seems most IT-shaped. Neither is a great strategy.

Here's the reframe that helps: the form is not an exam you can fail. It's a reasonably accurate list of the controls that actually reduce the chance of a very bad month. Treat it as a to-do list and the renewal stops being frightening.

What insurers are actually testing for

They are not expecting a bank-grade security programme from a twelve-person firm in Leeds. They are testing for a handful of things:

• Can an attacker log in with a stolen password? Hence the MFA questions.
• If ransomware lands, can you get your data back without paying? Hence backup questions — and increasingly, tested backup questions.
• Would you notice, and would you know what to do? Hence endpoint visibility and the incident response section.
• Are your answers true? This is the one people underestimate.

That last point matters. Under the Insurance Act 2015 you have a duty to make a fair presentation of the risk. Ticking "yes" to something you haven't actually implemented isn't optimism, it's a route to a declined claim and a wasted premium. If you're not sure, say you're not sure — and then fix it.

The four lines that trip up most small firms

"MFA is enforced on all remote access"

This is where the gap usually is, and it's rarely the obvious accounts. It's the legacy ones. Old protocols still enabled for a scanner or a creaking line-of-business app. A break-glass admin account that was excluded from the policy and then forgotten. A VPN or remote desktop gateway sitting outside the Microsoft 365 world entirely.

Turning MFA on for staff is straightforward. Hunting down the exceptions is the actual work.

"Backups are encrypted, offsite and tested"

Three claims, three different checks. Encrypted is a setting. Offsite means genuinely separate — a backup sitting in the same tenant, same subscription or same building is not offsite in any useful sense, and ransomware operators know this. Tested means someone restored a file and wrote down the date.

If you can't produce that date, you don't have a tested backup. You have a hope.

"Endpoint protection is deployed on all devices"

All means all. The finance director's personal laptop that occasionally checks email. The spare machine in the stockroom. The three devices bought during a busy period and never enrolled. Insurers ask for coverage because partial coverage is where incidents start.

"We have a documented incident response plan"

It doesn't need to be forty pages. It needs names, numbers and a sequence: who calls the insurer, who calls the IT provider, who talks to customers, who deals with the ICO's 72-hour reporting clock if personal data is involved. A single page printed and stuck in a drawer beats a beautiful document nobody has opened.

Gather the evidence before you need it

Insurers increasingly ask for proof, and a screenshot taken the week before renewal is worth more than a paragraph of reassurance. Keep a folder — literally a cloud folder with a sensible name — containing:

• A screenshot of your MFA enforcement policy, dated.
• A list of accounts excluded from that policy, with a reason for each.
• Backup configuration showing retention and where the copies live.
• A one-line restore test log: date, what was restored, who did it.
• Endpoint protection coverage numbers against your device count.
• Your incident response page, with current phone numbers.
• Your starter and leaver checklists — because access control questions are often really asking about joiners and leavers.

Refresh it twice a year. Renewal day becomes a ten-minute job rather than a two-week scramble.

Don't panic-buy in the wrong order

When the form exposes gaps, the temptation is a spending spree. Resist it, because the items are not equal value.

First, MFA everywhere. Cheapest meaningful control you will ever deploy, and the one insurers care about most. It also stops the majority of the attacks that generate claims in the first place.

Second, backups you have actually restored from. Not a new product necessarily — often just fixing the settings on what you already pay for, plus a calendar reminder to test.

Third, endpoint coverage and visibility. Get every device enrolled before you shop for something shinier.

Fourth, the written plan. Costs nothing but an hour and a pot of coffee, and it's the difference between a calm Monday and a chaotic one.

Notice that none of that is exotic. Cyber Essentials covers a good chunk of it and is a useful shorthand when an insurer asks what you've done — but the certificate isn't the point. The controls are.

Answer honestly, then close the gap

A practical approach for the next renewal: fill the form in truthfully, in pencil, before you send it. Every "no" becomes a task with a name against it. Some you'll fix in an afternoon. Some you'll fix in a month. Both are fine — what isn't fine is a "yes" you can't back up.

And if you genuinely can't answer a question, that's not a failure either. It's information. Usually it means nobody has looked at that setting since it was switched on, which is worth knowing regardless of what the insurer thinks.

The questionnaire is doing you a favour, awkwardly. It's an annual reminder that the boring controls are the ones that work — and that a bit of evidence gathering now is far cheaper than explaining a gap later.