Would your business pass a cyber insurance application today?
Cyber insurers now ask detailed questions about your security before they write or renew a policy. Work through 22 of the questions they actually ask, drawn from published Travelers, Beazley, Coalition and Chubb material, to see your gaps and the order to fix them in. Built for Canadian businesses by IT Rapid Support in Vaughan.
Print it and fill it in by hand, or work through it on screen. Want a second opinion on your answers? Call or send us a message and we will go through them with you.
The 22 questions
This is a checklist you work through yourself, on screen or on paper. There is no sign-up and nothing to submit.
Answer for your whole business. Each question has three answers: Yes, everywhere / Partly / No, or not sure.
| # | Area | Weight | Critical | Question |
|---|---|---|---|---|
1 | Multi-factor authentication | 6 | Yes | Is multi-factor authentication enforced on every email account, including webmail opened from personal devices? |
2 | Multi-factor authentication | 6 | Yes | Does every form of remote access (VPN, remote desktop, remote support tools) require multi-factor authentication? |
3 | Multi-factor authentication | 6 | Yes | Do all administrator accounts use multi-factor authentication, for internal as well as remote access? |
4 | Endpoint detection and response | 6 | Yes | Is endpoint detection and response (EDR), not only traditional antivirus, installed on every laptop, desktop and server? |
5 | Endpoint detection and response | 3 | Blank | Are security alerts watched by people who can isolate a machine or disable an account? |
6 | Endpoint detection and response | 3 | Blank | Do everyday users work without local administrator rights on their own computers? |
7 | Backups and recovery | 6 | Yes | Is at least one copy of your backups offline or immutable, so it cannot be deleted or encrypted from your network? |
8 | Backups and recovery | 4 | Blank | Have you restored key servers and data from backup as a test within the last six months, and kept a record? |
9 | Backups and recovery | 2 | Blank | Are backups encrypted, and made with a real backup product rather than relying on OneDrive, Dropbox or SharePoint sync? |
10 | Patching and vulnerabilities | 4 | Blank | Are critical security patches installed on a defined timeline, within 30 days of release at the latest? |
11 | Patching and vulnerabilities | 3 | Blank | Is every system still supported by its vendor, with anything end of life removed or cut off from the rest of the network? |
12 | Patching and vulnerabilities | 2 | Blank | Do you run scheduled vulnerability scans across your environment, or a penetration test each year? |
13 | Email security | 3 | Blank | Is incoming email filtered for malicious links and attachments, with suspicious messages quarantined? |
14 | Email security | 3 | Blank | Does your domain publish SPF, DKIM and a DMARC policy set to quarantine or reject? |
15 | Email security | 2 | Blank | Are Office macros from the internet blocked by default? |
16 | Privileged access | 4 | Blank | Are admin accounts separate from everyday accounts, kept to a small named list, and reviewed at least once a year? |
17 | Privileged access | 1 | Blank | Do staff use a company password manager instead of reusing passwords or keeping them in spreadsheets? |
18 | Security awareness training | 3 | Blank | Does every employee complete security awareness training at least once a year, with phishing simulations? |
19 | Incident response | 4 | Blank | Do you have a written incident response plan that names who to call first, including your insurer or broker, and has your team walked through it? |
20 | Network and logging | 3 | Blank | Is your network segmented, with firewalls that block inbound connections by default and guest Wi-Fi kept separate? |
21 | Network and logging | 2 | Blank | Are security logs from Microsoft 365, firewalls and servers stored centrally, kept for months rather than days, and reviewed? |
22 | Vendor risk | 2 | Blank | For vendors who can reach your systems or data, do you set written security requirements and review their access regularly? |
Reading your answers
Treat any "No, or not sure" as a gap, and any "Partly" as half a gap. The five critical controls below come first: a "no" on any of them puts an application at risk of decline, whatever the rest looks like. After that, fix the gaps with the heaviest weights first.
How the weighting works
Each question carries a weight from 1 to 6, printed next to it. A control fully in place keeps its full weight, a partial answer keeps half, and a missing or unsure answer keeps nothing. The points you keep, out of a possible 78, become a score from 0 to 100.
5 controls are marked critical: MFA on email, MFA on remote access, MFA on admin accounts, EDR on every device, and an offline or immutable backup. These are the answers most often described as able to stop an application on their own, so a "no" on any of them puts you at risk of decline and a "partly" caps you at conditional, whatever the total. Otherwise 80 and above reads as likely insurable, 55 to 79 as conditional, and below 55 as at risk of decline.
The questions come from documents insurers publish: the Travelers CyberRisk application and its Multi-Factor Authentication Supplement, the Beazley Ransomware Supplemental Application, Coalition’s list of essential cyber insurance requirements, and the focus areas Chubb lists for its cyber services. Each gap in your results names the document that asks about it. Our cyber insurance readiness checklist explains how to prepare for the application itself.
What this is not
It is not an underwriting decision and not any insurer’s real criteria. Every carrier’s form is different, forms change at renewal, and underwriters also weigh your industry, revenue, data and claims history. It is also not legal or insurance advice. Answer your real application accurately with your broker. An honest application with a higher premium is worth more than a cheaper policy that fails at claim time.
Closing the gaps
Cyber insurance readiness checklist
What insurers ask for, the gaps that trip up small businesses, and how to prepare before renewal.
Managed detection and response
EDR on every device, watched by people who can contain a threat at 2am.
Backup and disaster recovery
Offline and immutable copies, tested restores, and recovery targets you can write on an application.
Cyber insurance readiness FAQs
It checks your business against 22 security controls that appear on published cyber insurance applications and carrier guidance: multi-factor authentication on email, remote access and admin accounts, endpoint detection and response, offline or immutable backups with tested restores, patching timelines, email filtering and SPF, DKIM and DMARC, privileged access, security awareness training, an incident response plan, network segmentation, logging and vendor access. You get a score out of 100, a readiness band, and a list of what to fix first.
No. This page is a checklist with nothing to submit. It does not ask for your name, company or email, and nothing you pick is sent to IT Rapid Support or anyone else.
The questions are drawn from documents carriers publish themselves: the Travelers CyberRisk application and its Multi-Factor Authentication Supplement, the Beazley Ransomware Supplemental Application, Coalition’s published list of essential cyber insurance requirements, and the focus areas Chubb lists for its cyber services. Every insurer’s form is different and forms change at renewal, so treat this as preparation, not as any carrier’s actual criteria.
Five controls are marked as critical: MFA on email, MFA on remote access, MFA on admin accounts, EDR on every device, and an offline or immutable backup. Carriers and brokers consistently describe these as the ones that can stop an application on their own, so a "no" on any of them puts you in the at risk band whatever the rest of the score says. A "partly" on any of them caps the result at conditional.
No. Underwriting also looks at your industry, revenue, the data you hold, claims history and the limits you ask for, and only the insurer can decide. The checklist tells you whether your security controls are likely to be a problem, and what to fix before an application or renewal.
Mark it "No, or not sure" and treat it as a gap. On a real application, an answer you cannot back up with evidence is the one most likely to cause trouble at claim time. Ask your IT provider for proof, such as an MFA enrolment report, an EDR coverage count or the date of the last test restore, before you answer.
Want the gaps closed before your renewal?
We roll out MFA, EDR with monitoring, immutable backups and patching, then hand you the evidence your broker will ask for. Start with the email spoofing check if you want to test one control right now.
Related.
- ArticleCyber Insurance Readiness: What Insurers Now Require from Your ITCyber insurers now demand specific security controls before they will write or renew a policy. Here is what they ask for and how to get ready.
- ServiceManaged Detection and Response (MDR) Services and Cybersecurity MonitoringMDR services, short for managed detection and response, are a security service in which a team monitors your endpoints, servers, network and Microsoft 365 sign-ins…
- ArticleCloud Backup and Disaster Recovery: A Practical Guide for GTA BusinessesWhat Microsoft 365 and other cloud services keep for you, what they do not, and how to set up and prove a backup that covers the gap.
- ToolEmail Spoofing Check for Canadian Business DomainsHow to check the three DNS records that stop someone sending email in your name: SPF, DKIM and DMARC, using free public lookup tools or a call with us.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.