biz59.net
Free tool · runs in your browser

Cyber insurance application check

A broker sends a cyber application with forty-odd questions. Most of them don't move the price; a handful decide whether you get a quote at all, and a few more decide what the policy will refuse to pay later. Answer the 15 that matter most, as they stand today, and see which answers would stop a quote, which would shrink the cover and which only raise the price, with the fixes in order and what each costs.

Your answers are saved in this browser only. Nothing is sent to us.

– stop a quote · shrink cover · raise price · 0/15 answered
Answer the questions to see where you stand.
Does everyone need a second factor (app, key or code) to sign in to email, including on the web and phones? · MFA · a no can stop a quote
How the forms ask it

"For which of the following services do you enforce Multi-Factor Authentication (MFA)? Email" (Coalition); MFA "required for all employees when accessing email through a website or cloud based service" (Travelers CYB-14306).

Does every way into your network or servers from outside (VPN, remote desktop, SSH, remote support tools) need MFA? · MFA · a no can stop a quote
How the forms ask it

"Virtual Private Network (VPN)" and "Remote Desktop Protocol (RDP), RDWeb, RD Gateway, or other remote access", each with "N/A - no remote access allowed" (Coalition).

Not applicable if nothing can be reached from outside except cloud services that have their own MFA.

Do admin accounts need MFA: cloud console, domain registrar, code hosting, password manager, backups? · MFA · a no can stop a quote
How the forms ask it

"Network / cloud administration or other privileged user accounts" (Coalition); "all internal & remote admin access to directory services ... network backup environments" (Travelers CYB-14306).

Do you back up critical data and systems at least weekly, with one copy offline or in a separate account, and have you restored from it in the last 12 months? · Backups · a no can stop a quote
How the forms ask it

"at least weekly backups of all sensitive or otherwise critical data and all critical business systems offline or on a separate network" (Coalition); backups "tested on an annual basis?" (Travelers).

Is an endpoint detection and response (EDR) tool, not only antivirus, on every laptop and server? · Endpoints · a no raises the price
How the forms ask it

"Do you use an endpoint detection and response (EDR) product ... deployed on all endpoints?" and "What percentage of endpoints do not have EDR deployed and why" (CFC).

Are critical security patches installed within 30 days of release (high-severity within 7 is better)? · Patching · a no shrinks what is paid
How the forms ask it

"are critical patches installed within 30 days of release?" (Travelers).

Is everything you run still supported by its maker (no Windows 10 without extended updates, old servers, firewalls or frameworks past end of life)? · Patching · a no shrinks what is paid
How the forms ask it

"Do you have any end of life or end of support software?" (CFC).

Before paying a new bank account, a changed one, or a large transfer, do you confirm by phone on a number you already had? · Payments · a no shrinks what is paid
How the forms ask it

"secondary means of communication to validate the authenticity of: Funds transfer requests ... in excess of $25,000? ... Any request to change banking details" (Coalition).

Does your email filter attachments and links, and are SPF, DKIM and DMARC set up on your domain? · Email · a no raises the price
How the forms ask it

Email filtering and web security are one of Marsh's 12 key controls; applications ask about attachment sandboxing and domain authentication.

Do staff get security training and a simulated phishing test at least once a year? · People · a no raises the price
How the forms ask it

"Do you simulate phishing attacks to test employees at least annually?" (CFC).

Do people work day to day without admin rights on their own laptops, with separate accounts for admin work? · Endpoints · a no raises the price
How the forms ask it

Privileged access management is one of Marsh's 12 key controls; applications ask whether admin rights are restricted and separate.

Are laptops managed centrally, with disk encryption, screen lock, firewall and updates enforced? · Endpoints · a no raises the price
How the forms ask it

"Does Named Insured implement encryption on laptop computers, desktop computers, and other portable media devices?" (Coalition).

Is there a written incident plan: who decides, the insurer's breach hotline, the bank's fraud line, and how to reach staff if email is down? · Response · a no raises the price
How the forms ask it

Cyber incident response planning and testing is one of Marsh's 12 key controls; applications ask whether a plan exists and is tested.

Can you list every cyber incident of the last three years, claimed or not, and is there nothing you know of that could become a claim? · History · a no shrinks what is paid
How the forms ask it

"During the past three years, did Named Insured experience a cyber incident, claim or loss, whether insured or not" and knowledge of "any fact, circumstance, situation, or event that could reasonably give rise to a claim" (Coalition).

If you sell software or IT services: will you hold technology errors and omissions (tech E&O) cover alongside the cyber policy? · Software firms · a no shrinks what is paid
How the forms ask it

"Will Named Insured have an active technology errors and omissions policy concurrent with this insurance?" (Coalition).

Not applicable if you don't sell software or IT services.

Where this comes from

The questions follow the published applications of Coalition (US form CYUSP-00NA-1022-01), Travelers (CyberRisk and its MFA supplement CYB-14306) and CFC (US v25). What a weak answer does comes from Marsh's 12 key cyber controls (a gap in any of them raised the risk of being refused cover), Marsh McLennan's 2023 study linking each control to claims, Chubb's neglected software endorsement, Coalition's claims data and At-Bay's 2026 InsurSec report. Prices are list prices read on 24 October 2026 (Microsoft Defender for Business, Microsoft 365 Business Premium, Backblaze B2, Windows 10 extended updates). Each carrier weighs answers its own way; a broker decides what yours means.

What the policy then pays, with three claims worked through, is in our article cyber insurance for a small software company. The payment callback rule is explained in a cloned voice asks for a wire, and the payment rule builder writes it for your bank. For a customer's security questionnaire rather than an insurer's, use the security baseline self-assessment.

A pre-check, not an underwriting decision and not insurance advice. More free tools: biz59.net/tools.