What Your Cyber Insurance Renewal Will Actually Ask For

Renewal season is when most businesses find out what their cyber policy actually requires of them. The application arrives, somebody in finance completes it from memory or forwards it to whoever handles IT, and it goes back signed within the week. That form is the part worth slowing down for, because it is not a questionnaire. It is a set of statements you are warranting to be true.

The form is part of the policy

When a claim gets investigated, the carrier compares what happened against what you attested. If the application said multi-factor authentication was enforced across all accounts, and the intrusion arrived through a VPN login that did not have it, the distance between those two facts becomes the carrier’s strongest argument for paying nothing. That the omission was accidental does not help, and neither does the fact that nobody in the business knew the account was still active.

This is what catches well-run companies rather than careless ones. Almost nobody lies on these forms. What happens is that the person completing it describes the environment as it was designed rather than as it currently runs, because checking every line properly takes days and the renewal is due Friday.

The application is not asking what your policy says. It is asking what is actually deployed, and a claim investigation will go and look.

What carriers are asking for now

• MFA everywhere, including the awkward places. All users, all administrators, VPN and remote desktop included. App-based or hardware tokens rather than SMS. VPN access without it has become a specific underwriting flag.
• Detection somebody responds to. Coverage across servers as well as laptops, with monitoring around the clock. An endpoint licence generating alerts nobody reads is beginning to fail this question.
• Backups that have actually been restored. Offline or immutable copies, plus a documented successful restore within the last twelve months.
• A written incident response plan. Named roles, reviewed annually, with evidence that somebody ran a tabletop exercise against it.
• Centralized logging. Collected across endpoints, network and identity, with a stated retention period.
• Separated privileged access. Administrator accounts distinct from daily-use accounts, logged, and ideally time-limited.

The three that trip people up

Multi-factor coverage fails on the exceptions, never on the policy. The service account that could not handle it. The legacy application everyone agreed to revisit later. The executive who found the prompts irritating. The contractor VPN login from a project that finished in spring. Each exception was reasonable when it was made, and any one of them is the sentence that ends up quoted in a denial letter.

Backups fail on a different question than the one people hear. Everybody answers yes, because the jobs are running and the dashboard is green. Backup jobs report success while producing unusable output more often than anyone expects, and businesses tend to discover this during the worst week they have ever had. Pick something that matters, restore it, time how long it took and write the date down. That date is the honest answer to the question on the form.

The third is the gap between owning detection software and having someone respond to it, which is widening in how carriers assess risk. If your alerts land in a mailbox nobody opens until Monday, you hold the licence rather than the control. Renewal forms have started asking, in various wordings, which of those two you actually have.

Getting ahead of it

Complete the form from evidence instead of memory. For each control, decide in advance what document proves it: the enforcement report from your identity provider, the restore log with a date on it, the after-action notes from the tabletop, the coverage report showing every machine rather than most of them. Where a line cannot be evidenced, the honest answer is the cheap one, and it is considerably cheaper than the alternative.

Being unable to demonstrate the baseline is expensive. Businesses that cannot show the controls face sharp premium increases or get pushed toward surplus markets at much higher rates, which is unpleasant but survivable. Businesses that overstate the controls and then need to claim are in a different category of problem entirely.

Start sixty days out rather than the week the form lands. Most of these gaps take weeks to close: getting MFA onto the one system that resists it, scheduling a real restore test, writing a plan nobody has ever written down. Sixty days is comfortable. Five days is how businesses end up guessing on a legal document.

There is a useful side effect buried in all this. The control list carriers now demand is, very nearly, the list of things that would have prevented the incidents they are pricing. Treating the renewal as a security project rather than a paperwork exercise generally produces a better premium and a business that is less likely to need the policy at all.