Cyber insurance renewal: evidence to prepare

Cyber insurers increasingly ask you to prove that basic controls exist, not just to tick yes on a form. At renewal, expect questions about multi-factor authentication, backups, endpoint protection, patching, access reviews, incident response planning, vendor risk, and security training, with evidence behind each answer.

The work is easier if you treat renewal as an evidence project with a deadline, not as a paperwork event the week before it is due.

What the insurer is actually asking

Underwriters are pricing the chance that you will file a claim and the chance that you can recover from one. The questionnaire is how they estimate both. Some policies require a signed attestation from a company officer, which means the answers become representations the business is accountable for. Read every question literally, and involve your broker early. This is not legal advice, and coverage terms are the broker's and the carrier's to interpret.

The evidence checklist

For each item, the useful question is not "do we do this" but "what proves we do this".

Multi-factor authentication. Enforced on email, remote access, and administrative accounts. Evidence: an identity provider configuration report showing coverage, plus a named exceptions list with a reason and a date for each.

Backups and recovery. A defined schedule, copies that ransomware cannot encrypt or delete, and a restore test that actually ran. Evidence: the backup policy, the retention configuration, and a restore test record with the date and who verified it.

Endpoint protection. Endpoint detection and response or equivalent on every company device. Evidence: a coverage report from the management console showing the percentage of devices protected and the list of unprotected outliers.

Patch management. A cadence for operating systems and applications, with exceptions recorded. Evidence: a patch compliance report and an exception register with owners and review dates.

Access control. Single sign-on where possible, least privilege, joiner, mover, and leaver processes. Evidence: the most recent access review with reviewer names and decisions, and sample offboarding tickets.

Incident response. A written plan with roles, contacts, and decision authority, plus a record that it has been exercised. Evidence: the plan with a version date, and the notes and actions from the last tabletop exercise.

Vendor and third-party risk. An inventory of vendors that touch company or customer data, with reviews of the critical ones. Evidence: the inventory, the tiering, and a sample vendor review.

Security awareness training. Assigned to everyone, with completion tracked. Evidence: a completion report and the content dates.

Logging and monitoring. Which systems log, how long logs are kept, and who receives alerts. Evidence: a short document naming the sources, retention, and alert owners.

Network and remote access. Firewall rules that are reviewed, segmentation between office, production, and operational technology where it exists, and a remote access policy. Evidence: the last firewall review and the remote access configuration.

AI tools. Some renewal forms now ask whether staff use AI tools and whether there is a policy. Evidence: the AI inventory and the acceptable-use policy, if you have them.

How to prepare

Start a quarter before the renewal date. Ask the broker for the current form and any new questions, then build one folder with a document per answer. Where the answer is no, say no and describe the compensating control and the plan. An honest gap with a date is a better underwriting signal than a yes nobody can prove.

Keep the evidence current after the policy is issued. If an incident happens mid-term and the controls in the application were never in place, that is a coverage conversation nobody wants.

What not to do

• Answer from memory in a meeting and let someone else fill in the form.
• Let IT and the broker hold different versions of the truth.
• Sign an attestation without reading every answer.
• Buy a control only to tick the box, then leave it unmanaged.
• Treat the renewal as the finish line. It is the same evidence an audit will ask for.

Where this fits

The evidence an insurer wants overlaps heavily with SOC 2 and NIST CSF. Our paid Security & AI Risk Diagnostic produces the control-gap list and the roadmap, and the Compliance & Audit Readiness service builds the evidence file once and maps it to each framework and questionnaire.

If the renewal is close, request a briefing and bring the current form. We will tell you which answers you can evidence today and which need work first.