Guide · Cyber Insurance Readiness

Your insurer doesn’t underwrite promises. It underwrites proof.

Cyber insurance applications and renewals used to be paperwork. Today underwriters probe a short list of controls — and increasingly ask for the evidence behind the answers. This guide walks through the eight areas insurers check, the question behind each one, and the proof that actually counts.
↓ Get the free readiness checklist See the evidence list
The checklist condenses this guide into one page — 35 items, free.
The Evidence List

Eight areas every underwriter probes.

The wording varies by carrier. The substance does not. For each area: the question being asked, and the evidence that answers it. If you can produce the proof within one business day, you are ready. If you can only describe it, you have a gap — and renewal is the worst week to discover it.

1Multi-factor authentication

The question: is MFA enforced on email, remote access, and administrator accounts? The proof that counts: your MFA policy plus a coverage report from your identity provider showing who is enrolled — not a screenshot of one person's phone.

2Endpoint detection & response

The question: is EDR running on every workstation and server? The proof that counts: a console coverage report with device counts that match your inventory. 'We bought it' without full deployment is the most common gap insurers find.

3Backups that actually restore

The question: are backups isolated or immutable, and when did you last test a restore? The proof that counts: a dated restore-test record. A backup schedule proves intent; a restore test proves recovery.

4Patching & vulnerability management

The question: how fast are critical vulnerabilities patched? The proof that counts: recent scan summaries and patch reports with dates — a rhythm an underwriter can see, not a claim they have to trust.

5Email security

The question: are SPF, DKIM, and DMARC in place on your domains? The proof that counts: the published DNS records and DMARC reporting. This is the one area an insurer can verify from outside your building, in minutes.

6People controls

The question: do staff complete security awareness training and phishing testing? The proof that counts: completion records and test results by name and date, plus a process for repeat clickers.

7Incident response readiness

The question: do you have a written incident response plan, and has it been exercised? The proof that counts: the plan itself, with named roles and first calls, plus notes from a walkthrough or tabletop exercise.

8Access control & vendors

The question: who has privileged access, and which vendors can reach your systems or data? The proof that counts: access-review records, a leaver process that closes accounts the same day, and a vendor list with agreements on file.

Where Firms Get Caught

Three mistakes that cost firms at renewal.

Mistake one
Answering aspirationally. “We plan to enable MFA” written as “yes” is a misrepresentation — and insurers compare applications against the facts when a claim arrives. An honest “not yet, remediation under way” protects you; a hopeful “yes” can endanger the coverage itself.
Mistake two
Treating the application as a form, not an evidence request. The firms that renew smoothly keep the proof in one place — a risk register, dated test records, current reports. The firms that scramble rebuild a year of evidence in a week.
Mistake three
Starting at renewal. Most gaps on this list take weeks to close properly — MFA rollouts, backup restore tests, vendor reviews. Ninety days before renewal is a work plan. Nine days before is a negotiation from weakness.
Why Clyvara

Depth a generalist can’t offer. Access an enterprise firm won’t give you.

Research-Backed
The methodology behind every engagement is grounded in original doctoral research into why SMB cybersecurity programs actually fail.
Focused
Clyvara doesn’t sell IT support or general consulting. Cybersecurity advisory is the entire practice.
Accessible
Direct access to a credentialed principal consultant — not a junior analyst routed through account layers.
Start Here

Check yourself against the list — free.

The Security Questionnaire Readiness Checklist turns the eight areas above into 35 tick-boxes you can score in ten honest minutes. If boxes stay unticked, Clyvara’s Risk & Readiness Assessment closes them into a documented risk register and remediation roadmap — the evidence pack behind this renewal and every questionnaire after it.

↓ Get the free checklist Book a Risk Conversation