Cyber insurance application questions, and the evidence for each

Cyber insurance application questions cover the business and its losses, then a set of security controls: multi-factor authentication (MFA) on remote access, email and administrator accounts, endpoint detection and response (EDR), patching, unsupported systems, backups, email authentication, payment verification, incident response and training. A ransomware supplement asks the same controls in more depth. The answers are signed, but a signature is not evidence: for most of these questions the carrier holds, or can obtain, a document that shows whether the answer is true. Botminds' Cyber Underwriting Risk Assessment exists for that comparison. Its agents read the application, supplement, outside-in scan, penetration test and loss history, put every signed answer beside the evidence for it, and leave the underwriter to decide what each disagreement means for the quote.

The work is hard because the documents arrive separately and speak different languages. The application says "Yes"; the scan says 3389/tcp open; the penetration test names two service accounts. Matching them takes an experienced reader, and on a mid-market account Botminds estimates three to four hours of reading before an underwriter can write a single subjectivity. The map below is the short version of that reading.

What questions are on a cyber insurance application? Four families

The questions fall into four families, and the only peer-reviewed study of filed applications counts them. Sasha Romanosky and colleagues at RAND downloaded 235 cyber insurance filings from the New York, Pennsylvania and California insurance departments, covering 2007 to 2017, and found questionnaires in 31 of them (Journal of Cybersecurity, 2019). They sorted 118 distinct topics into four themes: the organisation, technical controls, policies and procedures, and legal and compliance.

Policies and procedures drew the most questions (51), then the organisation (35), technical controls (21) and legal and compliance (11). The median questionnaire asked 26 questions, and the study found that "questions regarding such technical measures were present in almost all applications". The most common procedural question was whether a data retention and destruction policy existed.

The balance has since moved. New York's Department of Financial Services, in its 2021 Cyber Insurance Risk Framework, listed the topics an insurer's information-gathering should cover: "corporate governance and controls, vulnerability management, access controls, encryption, endpoint monitoring, boundary defenses, incident response planning and third-party security policies" (DFS Insurance Circular Letter No. 2, 2021). Every item on that list is a technical or operational control. A current application reads less like a policy inventory and more like a short audit, and the ransomware supplement takes the audit deeper.

What does a cyber insurance application ask about MFA? Scope is the whole question

Applications ask about MFA in three places, and the scope words decide what a "Yes" means. Remote access is the first: a well-drafted question names VPN, remote desktop and remote management tools, because each is a separate door. Email is the second, best phrased as "every user" so that a single legacy mailbox without MFA makes the answer false. Privileged accounts are the third, and the careful version names service accounts, which are easy to leave on a password because a script, not a person, signs in with them.

A question that asks only "Do you use MFA?" invites a true answer that tells the underwriter nothing: an organisation with MFA on a single system can answer it yes. The useful question fixes the scope, offers "Partly" as an answer, and asks which systems are excluded. Does cyber insurance require MFA? sets out which kinds of MFA count and what a signed yes can and cannot prove.

What is a ransomware supplemental application, and when is it asked for?

A ransomware supplement is a second questionnaire that asks the controls ransomware tests: backups and whether they survive an attacker with administrator rights, MFA on the backup console, EDR coverage as a device count, network segmentation, remote desktop exposure, and the incident response plan. Each carrier sets its own trigger, such as a revenue band or an industry. In the fictional sample submission used across this series, a $186.4 million freight company, the carrier's rule asks for the supplement above $25 million of revenue, and the broker's supplement runs to six pages and 41 questions.

The supplement's backup questions track public guidance closely. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) tells every organisation to "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario", because "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups" (CISA #StopRansomware Guide). A supplement that asks only "Do you have backups?" misses both halves of that sentence: offline or immutable, and tested.

Supplements also turn yes-or-no answers into numbers, which is where they become checkable. "EDR on all endpoints" becomes "how many devices, and how many carry the agent". In the sample, the application answers yes; the supplement counts 612 of 651 devices, or 94%, with 39 terminal servers missing the agent. Both documents are signed by the same company, and they disagree.

Which cyber application answers can an outside-in scan confirm?

An outside-in scan can settle any answer about what an attacker on the internet can see, and nothing else. That covers open remote desktop and VPN logins, whether they show an MFA prompt, software versions in banners, expired certificates, the email records a domain publishes, and credentials that have appeared in breach data. It does not cover anything behind the perimeter: whether administrator accounts use MFA, how many laptops run EDR, or whether the last restore test worked.

That split decides the evidence plan for each submission. Four of the ten questions in the map above can be settled from outside and two more partly; the rest need the insured's own penetration test, a supplement count, a dated test report or a screenshot of a policy. The scan matcher's job, and its limits, are in the guide to cyber insurance security scan tools, and the dated question a scan makes possible on patching is in CISA's known exploited vulnerabilities catalog, used by underwriters.

The application, with every answer the scorecard used marked in the margin

The application is 14 pages, signed 18 Sep 2026 by the company's CFO. The scorecard used answers from it on eight of fifteen controls.

How do insurers verify cyber application answers?

Insurers verify answers by putting them beside evidence from outside the application, and New York's regulator has said they should. The DFS framework asks every authorized property and casualty insurer writing cyber to "Rigorously Measure Insured Risk", with "a data-driven, comprehensive plan for assessing the cyber risk of each insured and potential insured". Surveys and interviews are where that "commonly starts", the circular says, but "Third-party sources, such as external cyber risk evaluations, are also a valuable source of information" (DFS Circular Letter No. 2, 2021).

The circular adds a harder step: the information "should be compared with analysis of past claims data to identify the risk associated with specific gaps in cybersecurity controls." That only works if each application answer and each piece of evidence is stored against the same named control, submission after submission, so that a later claim can be traced to the answer that preceded it. A note that says "scan reviewed, some issues" cannot be analysed against claims; a grade per control can.

What happens if you answer a cyber application wrong? Materiality decides

A wrong answer does not void a policy by itself; in New York, it has to be material. Insurance Law § 3105 treats each answer on an application as a representation of past or present fact, lets a misrepresentation avoid the policy or defeat a claim only if it was material, and sets a narrow test: material means that, had the insurer known the true facts, it would have refused to make the contract (N.Y. Ins. Law § 3105). How New York, Florida and the UK draw that line differently is compared in misrepresentation on an insurance application.

The next subsection is the one underwriters should read twice. When materiality is disputed, the insurer's own practice in accepting or declining similar risks is admissible evidence (§ 3105(c)). A carrier that can show a written minimum-controls guide, applied the same way to every similar submission, is in a far stronger position than one whose practice lives in individual underwriters' heads. Other states and other countries use different tests, and none of this is legal advice; the practical point holds anywhere: a contradiction found before the quote becomes a subjectivity, and one found after a loss becomes a dispute.

Why a blank cyber application answer should stay blank

A blank answer is information: it says the applicant did not, or could not, say. Filling it with the likely answer, because most companies of that size have EDR or because the broker said so on the phone, removes the one signal that the question needs asking again. It also blurs who said what, which matters if the answer is ever tested under a statute like § 3105, where the representation must be made "by, or by the authority of" the applicant.

The same applies to the qualified answer. "Partly", "in progress" and "most systems" are different from "Yes", and the difference is usually where the risk is. A reader that rounds them up produces a cleaner scorecard and a worse one. In Cyber Underwriting Risk Assessment the submission reader is set never to infer an answer that was not given: a blank stays "not answered", and a qualified answer is kept as written and graded as partial or sent to the broker as a question.

How Cyber Underwriting Risk Assessment maps each application answer to its evidence

The solution runs the map at the top of this page on every submission, the day it arrives. Its submission reader extracts each answer with its question number, page and signer, and turns counts such as devices with EDR into numbers. The scan matcher reads the outside-in scan the carrier ordered and the penetration test the broker sent, and ties each finding to a control. The control grader puts the two side by side against the carrier's own minimum-controls guide and grades each control: meets, partial, gap, contradicted, ask the broker, or watch.

On the sample submission that produced 212 answers from five documents, 20 scan and penetration-test findings, and three contradicted answers, each of which the subjectivity writer turned into a pre-bind subjectivity worded from the carrier's approved library. The underwriter decides each one: keep it, ask the broker, or override it with a reason. The agents never quote, bind or contact the insured.

The outside-in scan, with each finding tied to the answer it tests

The scan is read, never run: the agents do not probe the insured's systems.

Questions people ask

What is a cyber insurance questionnaire?

It is the security section of the application, or a separate form, in which the applicant answers questions about its controls. The 2019 RAND study of filed policies found questionnaires in 31 of 235 filings, with a median of 26 questions. The sample application in this series runs to 14 pages, with a six-page ransomware supplement.

Do cyber insurers scan your network?

A carrier may order an outside-in scan, which looks only at what is reachable from the internet, such as open ports, login pages, software banners and published email records. It is not a penetration test and does not enter the network. The DFS framework names "external cyber risk evaluations" as a valuable source alongside the application.

Who should complete a cyber insurance application?

Whoever signs it is making the statement for the company, so the answers should come from the people who run the controls, usually IT and security, and be checked by the officer who signs. In the sample the CFO signed, and the remote-access answer on his form was contradicted by an exposure the company's own IT team could have seen from outside.

Can I answer "partly" on a cyber application?

If the form allows it, a qualified answer with the exceptions named is better than a yes that is untrue. New York's § 3105 lets an insurer avoid a policy only for a material misrepresentation, one that would have led it to refuse the contract; disclosing the exception lets the underwriter price it or add a condition instead.

Do application questions change at renewal?

The questions change when the carrier's guide changes, and the answers should be re-tested at each renewal because the evidence changes faster than the form. A remote desktop port can open in a week, and CISA added 276 entries to its known exploited list between January and late October 2026.

What does a cyber application ask about past incidents?

It asks for known compromises, claims and incidents over a look-back period, and the loss history should agree: the sample form asks about three years and the loss history covers five. In the sample, a March 2024 spoofed-invoice loss of $84,300 explains why the payment call-back answer and the domain's DMARC setting both deserve a second look.