How to answer cyber insurance security questions honestly

TL;DR — Cyber insurance forms are easiest when you answer from evidence, not memory. Build a one-page worksheet from your admin dashboards first, and if a control is only partly deployed, answer "no" and add a short note such as "enabled for Microsoft 365 admins only" instead of guessing. Reading time: ~5 min

Goal

When you are done, you will have a completed cyber insurance questionnaire with each answer backed by something you can see now in an admin dashboard, policy screen, billing page, or recent report, plus a short note for any partial control so you can answer honestly and consistently.

Prerequisites

• Your cyber insurance application or broker questionnaire in PDF, web form, or spreadsheet form
• Admin or read-only access to the systems your business uses for identity, email, devices, backups, and cloud hosting
• A place to collect answers, such as a spreadsheet or document
• Your company facts at hand: legal name, website, employee count, annual revenue, and list of critical systems
• Access to your identity provider (IdP, the system that handles logins), for example Microsoft Entra ID, Google Admin, Okta, or similar
• Access to your email admin console, for example Microsoft 365 admin center or Google Admin
• Access to your endpoint or device management console, if you have one, for example Intune, Jamf, Kandji, or your antivirus dashboard
• Access to your backup dashboard or your hosting provider dashboard, if you claim backups, disaster recovery, or logging
• A browser that can save screenshots or PDFs

Steps

Step 1: Create an evidence worksheet before answering anything

Create a table in a spreadsheet or document with these exact columns:

Question | Your answer | Evidence source | Screenshot/export saved? | Notes/limits

If you prefer, copy this starter table:

What you should see when this succeeds: a worksheet with one row per insurance question and empty spaces for proof.

Step 2: Answer only from a dashboard, report, or written policy

For each question on the application, open the matching admin screen first. Use your provider's dashboard, for example:

Identity provider dashboard (e.g. Microsoft Entra admin center, Google Admin, Okta)
Email admin dashboard (e.g. Microsoft 365 admin center, Google Admin)
Device/security dashboard (e.g. Intune, Jamf, antivirus/EDR console)
Backup dashboard (your backup vendor or cloud provider)
HR/LMS dashboard for training records
Document storage for written policies and incident response plan

Then fill the worksheet row before you fill the insurance form.

What you should see when this succeeds: each worksheet row points to a real screen, report, or document you can reopen.

Step 3: Use the strict rule for "yes", "no", and "partial"

Apply these exact answer rules while filling the worksheet:

Answer "Yes" only if the control is enabled now for the full scope asked in the question.
Answer "No" if the control is missing, optional, pilot-only, or enabled for only some users, devices, or systems.
If the form has no "Partial" option, choose "No" and add a note with the exact limit.

Use notes like these, copied exactly and edited only where needed:

MFA enabled for administrators only; not yet enforced for all users.
EDR installed on company laptops; not installed on employee-owned devices.
Backups run daily for production database; restore test not completed in last 12 months.
Security training assigned at onboarding; no recurring annual phishing simulation.

What you should see when this succeeds: your worksheet has plain-language notes instead of guesses.

Step 4: Gather the most commonly requested evidence

Open the dashboards or documents that support the most common insurance questions and save a screenshot or export for each one you claim as "yes":

Identity provider → MFA or authentication policies page
Email admin → anti-phishing, spam, or advanced protection policy page
Device/security console → device compliance, antivirus, or EDR coverage page
Backup system → job status, retention, immutability, or restore history page
Patch management console → update compliance or missing patches report
Document repository → incident response plan, business continuity plan, vendor risk policy
Training platform or HR system → completion report for security awareness training

Name files like this so you can find them later:

2026-10-mfa-policy.png
2026-10-edr-device-coverage.png
2026-10-backup-job-status.png
2026-10-ir-plan.pdf

What you should see when this succeeds: you have one saved file per "yes" answer, with filenames that match the worksheet.

Step 5: Translate common insurance wording into plain English before answering

Use this table when the form uses insurance language instead of product names:

What you should see when this succeeds: you can map each vague question to one specific screen or document.

Step 6: Complete the application from the worksheet, not from memory

Open the insurance form and copy answers from your worksheet row by row. If the form has a comments field, paste your limit note exactly when a control is partial.

Use wording like this:

No — MFA is currently enforced for administrators and finance users only.
Yes — Daily backups are enabled for production systems and retained for 35 days.
No — Annual security awareness training is not yet implemented for all employees.

What you should see when this succeeds: every answer in the application matches a worksheet row and, where needed, a saved screenshot or document.

Step 7: Do a final honesty check on the high-risk questions

Before submitting, review these questions one more time because they are the ones most likely to cause trouble later if overstated:

MFA for all users or all remote access
Backups and restore testing
EDR/antivirus coverage on all company-managed devices
Patching timeframes for critical systems
Admin account restrictions
Security monitoring/log retention
Written incident response and business continuity plans

If any answer depends on words like "mostly", "usually", or "we are rolling it out", change it to "No" and add a note.

What you should see when this succeeds: there are no answers left that rely on assumptions or future plans.

Verify it works

Use this checklist before you submit:

1. Every "Yes" answer has a matching dashboard screen, export, or written policy.
2. Every partial rollout is marked "No" unless the form explicitly offers "Partial".
3. Notes describe the exact scope, such as "admins only" or "production only".
4. Saved evidence filenames match the worksheet rows.
5. A second person in your company can read one row and reopen the same evidence source.

A successful result looks like this: you can point to proof for each claimed control within 30 seconds, and no answer depends on "we intend to" or "our IT vendor probably does that."

Common pitfalls

Pitfall 1: Answering for one system as if it covers the whole company

Mistake: You checked one product, such as Microsoft 365 MFA, and answered "yes" for all users and all systems.

Symptom: Later you realize VPN, payroll, Git hosting, or another app does not require MFA.

Fix: Change the answer to "No" and note the exact scope, for example "MFA enabled for Microsoft 365 only."

Pitfall 2: Treating purchased software as deployed protection

Mistake: You bought EDR, backups, or phishing protection and answered "yes" without checking rollout status.

Symptom: The console shows only some devices, some mailboxes, or no successful backup jobs.

Fix: Open the coverage or job-status page and answer from that screen, not from the invoice.

Pitfall 3: Calling a policy "implemented" when it is only a document

Mistake: You have an incident response plan or security policy file and answered "yes" to operational controls too.

Symptom: The document exists, but there is no training, no test, or no technical enforcement.

Fix: Answer "yes" only for the document question; answer technical enforcement questions separately from the actual dashboard.

Pitfall 4: Counting optional settings as mandatory controls

Mistake: Users can enroll in MFA or devices can install updates, but enforcement is not turned on.

Symptom: Admin screens show "available" or "recommended" instead of "required" or "enforced."

Fix: If the control is optional, answer "No" and note "available but not enforced."

Pitfall 5: Ignoring restore tests when claiming backups

Mistake: You answered "yes" to backups without checking whether anyone has restored data recently.

Symptom: Backup jobs are green, but there is no restore history or test record.

Fix: If the question asks about tested recovery, answer "No" unless you have a dated restore test record.

Pitfall 6: Letting a vendor or MSP answer from memory

Mistake: An outside IT provider says "yes, you have that" without showing the admin screen or report.

Symptom: You cannot produce proof when the insurer or broker asks follow-up questions.

Fix: Ask for the exact dashboard screenshot, export, or policy document before you submit the answer.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.