Your cyber insurance application is a control checklist

The most useful security document in your firm

Every year your firm fills out a cyber insurance application or renewal questionnaire. It asks whether you enforce multi-factor authentication on email, whether you have endpoint detection and response on every device, whether backups are offline or immutable, whether you have an incident response plan, whether privileged accounts are separated from everyday ones. Then somebody signs it.

Underwriters wrote those questions because each one changes the probability or the cost of a claim. That makes the application the shortest, best-priced list of controls you will find. It is also a legal document: a misstatement on it is the most common reason a carrier disputes a claim.

Three ways firms get this wrong

Answering from intention rather than configuration

“Yes, we require MFA” usually means a policy says so. The question is whether the Microsoft 365 tenant enforces it for every account, including the shared mailbox the operations team uses and the break-glass admin account nobody remembers. Carriers increasingly verify this with external scans and, after a claim, with log review.

Letting the IT provider answer alone

Your IT provider knows what they installed. They do not know what the custodian portal requires, which staff have access to client PII in the CRM, or what the firm's Regulation S-P obligations are. The CCO has to own the answers, with IT supplying the evidence.

Treating a “no” as a pricing problem instead of a to-do list

A “no” on the application raises the premium or narrows coverage. It is also a control you do not have. The firms that come out ahead fix the control before renewal, keep the evidence, and go back to the carrier with a better answer.

How to use the application as a plan

• Take last year's application and, for every “yes”, write down where the proof lives: a screenshot of the Conditional Access policy, the EDR console export, the backup restore test log.
• For every “no” or “partial”, estimate what it would take to make it a true “yes”. Most of them, for a Microsoft 365 firm with no servers, are configuration rather than purchases.
• Have the CCO and the IT provider sign off together, so the person attesting and the person configuring agree on what is actually in place.
• Keep the evidence file. If you ever file a claim, the adjuster will ask for it.

Where this meets the regulator

The overlap between a 2026 cyber insurance application and the amended Regulation S-P safeguards rule is large: MFA, logging, incident response, vendor oversight, data disposal. Doing the work once and keeping one evidence file serves both the carrier and the examiner.

Our assessment starts with your application. We verify each answer against the actual tenant configuration and tell you where the attestation and the reality diverge. Request an assessment.