Cyber insurance used to be a form with a dozen boxes. It is now a technical questionnaire, and the answers you give are treated as warranties. Get one wrong and you may be paying premiums for a policy that will not respond when you claim on it.
That is the part most business owners have not been told. Insurers are not only pricing your risk from these answers, they are establishing what you represented to be true. The five questions below are where we see Georgia businesses answer optimistically, and they are the five worth checking before you sign anything.
1. “Is Multi-Factor Authentication Enabled On All Email Accounts?”
The trap is the word all. Businesses turn on multi-factor authentication for staff and leave a handful of accounts out: a shared mailbox, a service account used by an application, a departed employee’s account left active, or the administrator account that was too disruptive to change.
Any of those is enough to make the answer inaccurate. Before you answer, ask for a list of every account on the tenant and its authentication status, not a summary. It is a five-minute report and it either confirms your answer or saves your claim.
2. “Do You Have Offline Or Immutable Backups?”
Many businesses answer yes because backups go to a cloud service. That is offsite, which is not the same as offline or immutable. The test is simple: if an attacker gained administrator rights on your network tonight, could they reach and delete those backups? If yes, the honest answer to the question is no.
This one matters twice, because it is both a coverage question and the single control that most often determines whether a ransomware event becomes a bad week or a bad year.
3. “Do You Provide Security Awareness Training To All Employees?”
Sending an email about phishing once is not a training program. Insurers increasingly want a recurring program with records: who was enrolled, who completed it, when, and what the simulated phishing results were.
If you cannot produce that record on request, answer accordingly. A partial yes with a note is far safer than a clean yes you cannot evidence.
4. “Do You Have Endpoint Detection And Response Deployed Across The Environment?”
Traditional antivirus and endpoint detection and response are different products, and the question means the second one. Insurers are asking whether something is watching behavior, capable of isolating a machine, and being monitored by somebody who will act at three in the morning.
Software installed but unmonitored is a common and expensive middle ground. If nobody is watching the alerts, say so, because that gap is exactly what the question is designed to find.
5. “Do You Have A Written And Tested Incident Response Plan?”
Written and tested are two separate claims. A document that exists but has never been walked through is a document, not a plan. Insurers ask because the first four hours of an incident determine most of the cost, and companies that have rehearsed those hours cost them dramatically less.
A tabletop exercise once a year, with the results written down, satisfies this properly and takes an afternoon.
How To Answer Safely
Three habits protect you. Answer from evidence rather than memory, and keep the evidence with the application. Where a control is partial, say partial and describe it, because insurers price nuance and they do not forgive inaccuracy. And have whoever manages your IT sign off on the technical answers in writing before submission, so that the answers are not one person’s best recollection.
If any of the five made you pause, that is useful information regardless of insurance. These are the controls that stop incidents, which is why the insurers chose them.
We help clients answer these accurately and close the gaps that the answers reveal, through our compliance and cyber insurance support. If you would rather know where you stand before the renewal lands, book a free cyber assessment and an engineer will walk through these controls with you.
For the underlying control set that most insurer questionnaires are drawn from, the Center for Internet Security Critical Security Controls is the clearest public reference.