What your cyber insurer actually wants to see, and why "yes" is the most dangerous answer on the form
A client asked us to update the list of security work we'd done for them so they could send it straight to their insurer. Easiest renewal they've ever had. Here's why, and where most businesses trip up.
It's not admin, it's a declaration
Most people treat the renewal form like a bit of paperwork to get out of the way. It isn't. Your policy is priced and written on what you put on it.
So when someone ticks "yes, MFA is enforced on all accounts" and three accounts were never set up, that's not a technicality. If you ever need to claim, that answer is one of the first things that gets checked, and a wrong one can reduce or kill the payout. Right at the moment you need it most.
Here's the uncomfortable bit. The biggest risk we see isn't a missing control. It's a business confidently saying "yes" to something that's only mostly true.
What insurers are actually asking about
The same eight things come up on almost every form we see. The wording changes, the questions don't. The right-hand column is the bit worth reading twice.
| Control | What the form usually asks | What "good" looks like | The gap we find most often |
|---|---|---|---|
| MFA | Is MFA enforced on email and remote access? | Enforced for every user via Conditional Access, no exceptions left over from setup | Shared mailboxes, old admin accounts, or "just this one user" exclusions |
| Email security | Do you filter malicious links and attachments? | Safe Links, Safe Attachments and anti-impersonation switched on (Business Premium or equivalent) | On Business Standard, so the features simply aren't there |
| DMARC | Is your domain protected against spoofing? | DMARC set to quarantine or reject, with reports reviewed | Set up in "monitor only" mode years ago and never finished |
| Endpoint protection | Do you have EDR or 24/7 monitoring? | Detection and response on every device, with someone watching out of hours | Antivirus installed, nobody looking at the alerts |
| Patching | Are critical updates applied within X days? | Managed, reported patching, so you can prove compliance | Updates "switched on" but devices quietly failing for months |
| Backups | Are backups offsite, and tested? | Independent, offsite backups including Microsoft 365, with test restores | Assuming Microsoft backs up your mailboxes. It doesn't, not in the way you think |
| Mobile devices | How is business data protected on phones? | Device management with the ability to wipe company data remotely | Email on personal phones with no controls at all |
| Staff training | Do staff receive security awareness training? | Regular phishing simulations and short, recorded training | A one-off session three years ago |
What it looked like for a real client
When this client came to us, that table would have been a rough read. Basic mail filtering, DMARC never enforced, Microsoft 365 never backed up, and a handful of devices that had quietly stopped updating without anyone noticing.
We spent the first six months working through it. Business Premium for the security features, DMARC moved to strict, DNS filtering and 24/7 threat detection on every device, phishing simulations for the team, phones brought under management, and proper offsite and M365 backups for the first time.
None of it was done for the insurer. It was done because it needed doing. But we wrote it down as we went, so when renewal came round, it was one email: "anything to add to this list?" That's it.
What to actually do before your next renewal
Not a checklist to print and forget. These are the things that genuinely change how that form goes.