What a Cyber Insurance Application Asks: MFA, Backups, Training, and More

A cyber insurance application asks about your business, the data you hold, and your security controls: multifactor authentication, backups, endpoint protection, patching, email security, training, and how you verify payments. It also asks about prior incidents and anything you know that could lead to a claim. The answers become part of the policy, so each one has to be accurate.

By Trella Commercial · Updated October 4, 2026

The short version

Cyber applications are security questionnaires. Expect 20 to 60 questions, most of them about how your systems are protected.
Who should answer: the owner or officer who signs, together with whoever runs your IT, whether that is an employee or an outside provider.
The answers are part of the contract. An inaccurate "yes," especially on multifactor authentication or backups, can give the insurer grounds to deny a claim or rescind the policy.
Fix before you apply. If a control is missing, adding it first usually gets better terms than explaining the gap.
Insurers check from the outside too. Most scan your website, email domain, and internet-facing systems before quoting.

Section 1: About your business

Question	Why they ask	Tip
Legal name, address, and website	Identifies the insured and the domain they will scan	List every website and email domain you use
Industry and description of operations	Sets the base rate	Be specific; "dental practice" rates differently from "health care"
Annual revenue, current and projected	Proxy for size and downtime cost	Use the same figure as your other applications
Number of employees	Indicates attack surface	Include contractors with network access
Subsidiaries and other locations	Determines who is covered	List every entity that should be insured

Section 2: The data you hold

Question	Why they ask	Tip
How many records containing personal information do you hold?	Breach response and liability costs scale with it	Count customers, patients, clients, and current and former employees
What types: Social Security numbers, health, financial, card data, biometric?	Sensitive data costs more after a breach	Washington's breach law covers all of these; see what counts
Do you store card numbers, and are you PCI compliant?	Card breaches bring brand assessments	Using a processor's hosted payment page usually means you do not store card data
Is sensitive data encrypted at rest and in transit, including laptops?	Encrypted data usually does not trigger breach notice	Confirm full-disk encryption on every laptop
Do you collect health data or biometric data?	Privacy law claims risk	In Washington, think about the My Health My Data Act

Section 3: Multifactor authentication

Usually the first and most important controls section. Many insurers decline or exclude ransomware without good answers here.

Question	What a strong answer looks like
Is MFA required for all employees to access email?	Yes, for every mailbox, including shared and former-employee accounts
Is MFA required for remote access to your network (VPN, remote desktop)?	Yes, or you have no remote access to the network
Is MFA required for administrator and privileged accounts?	Yes, with separate admin accounts used only for admin tasks
Is MFA required for cloud apps and backups?	Yes, including your backup console and banking
Is remote desktop (RDP) open to the internet?	No

Check before you answer. It is common to find a few mailboxes, an old admin account, or a vendor login without MFA.

Section 4: Backups and recovery

Question	What a strong answer looks like
How often do you back up critical data?	At least daily for systems you cannot run without
Are backups kept offline, immutable, or otherwise separated from your network?	Yes; ransomware cannot reach or delete them
Are backups encrypted?	Yes
Have you tested restoring from backup, and when?	Yes, with a recent date
How long would it take to restore critical systems?	A realistic estimate, based on the test

Section 5: Endpoint protection, patching, and email

Question	What a strong answer looks like
Do you use endpoint detection and response (EDR) on all computers and servers?	Yes, ideally monitored around the clock by a provider
How quickly are critical security patches applied?	Within a defined window, such as 14 or 30 days, faster for actively exploited flaws
Do you run any unsupported or end-of-life software or operating systems?	No, or it is isolated from the network
Do you filter incoming email for malicious links and attachments?	Yes
Have you set up SPF, DKIM, and DMARC on your email domain?	Yes
Do users have local administrator rights on their computers?	No

Section 6: People and procedures

Question	What a strong answer looks like
Do employees receive security awareness training?	Yes, at least annually, with phishing simulations
Before changing vendor bank details or sending a large payment, do you verify by calling a known number?	Yes, always, using a number already on file, not one from the request
Do you have a written incident response plan?	Yes, including who to call first: your insurer's breach hotline
How do you manage vendors with access to your systems or data?	Contracts with security requirements, and MFA on their access
Do you have an outside IT or managed security provider?	Name them; they may need to help answer the application

Section 7: Prior incidents and known circumstances

Question	Why it matters
Have you had a breach, ransomware attack, or funds transfer fraud in the past several years?	Prior incidents affect price and terms
Have you received a claim or regulatory inquiry about privacy or security?	Same
Are you aware of any circumstance that could reasonably lead to a claim?	Known circumstances are typically excluded from the new policy
Has another insurer declined, canceled, or non-renewed your cyber coverage?	Underwriting history

The known-circumstances question deserves care. If you know about suspicious activity, a phishing incident, or a demand letter, disclose it. Coverage for that matter usually belongs with a prior policy, if any, and hiding it can void the new one.

How to prepare

Get your IT person or provider in the room. Most "I'm not sure" answers are settled in a 30 minute call with them.
Run an MFA audit. Check email, remote access, admin accounts, cloud apps, backups, and banking for every user.
Do a test restore from backup and write down the date and how long it took.
List your records: how many people, and what types of data.
Confirm laptop encryption and EDR coverage on every device.
Check your domain: SPF, DKIM, and DMARC, plus anything open to the internet that should not be.
Write your payment verification rule if it is not already written.
Gather incident history for the past several years.

What happens if an answer is wrong

The signed application is typically attached to and made part of the policy. If a material answer was untrue, for example MFA was not actually required on email, the insurer may deny a related claim or try to rescind the policy entirely. Some policies also exclude losses caused by failing to maintain the controls described in the application. If something changes after you apply, such as a control being turned off, tell your broker before the policy binds.

Common questions

What questions are on a cyber insurance application?

Questions about your business and revenue, the types and number of records you hold, multifactor authentication, backups, endpoint protection, patching, email security, training, payment verification procedures, vendor access, prior incidents, and known circumstances that could lead to a claim.

Can I get cyber insurance without MFA?

Some insurers will decline or exclude ransomware coverage without multifactor authentication on email and remote access. Adding MFA before you apply is usually the most effective way to improve both eligibility and price.

Who should fill out the cyber insurance application?

The officer who signs it, working with whoever manages your IT. Technical questions about backups, endpoint protection, and patching are best answered by your IT staff or managed service provider, but the signer is responsible for the answers.

What happens if I answer a cyber application question wrong?

Because the application becomes part of the policy, a material misstatement can let the insurer deny a claim or rescind the policy. If you discover an error or a control changes, tell your broker promptly so the application can be corrected.

Do insurers check my answers?

Many insurers scan your internet-facing systems before quoting and may ask follow-up questions about what they find. After a claim, forensic investigators will see how your systems were actually configured.

Sources

This page describes questions commonly found on cyber insurance applications. Each insurer's application differs. Reviewed October 2026.

More in this guide

Cyber Insurance for Washington and Idaho Small Businesses: The Complete Guide
The complete guide this page is part of.
Washington Data Breach Notification Law: What a Small Business Must Do
Washington's breach law, RCW 19.255, explained for small businesses: what counts as personal information, the 30-day deadline, Attorney General notice, what the notice must say, vendors, encryption, and penalties.
Washington's My Health My Data Act: The Privacy Risk Most Businesses Miss
Washington's My Health My Data Act (RCW 19.373) reaches gyms, wellness studios, salons, apps, and retailers, not just health care. Who it covers, what it requires, the 2,000-foot geofence ban, and how cyber insurance fits.
What Does Cyber Insurance Cover? First-Party and Third-Party Coverage, Explained
Every part of a cyber insurance policy explained: breach response, ransomware, business interruption, data restoration, wire fraud, liability, regulatory, PCI, and media coverage, plus how limits, sublimits, and waiting periods work.
What Cyber Insurance Does Not Cover (and the Exclusions That Matter)
The cyber insurance exclusions and conditions that cause denied claims: prior knowledge, failing to maintain security controls, war and infrastructure exclusions, wrongful collection, betterment, contractual liability, and the gaps between cyber and crime.
Does My BOP or General Liability Policy Cover a Data Breach?
Why most business owners policies and general liability policies do not cover data breaches, ransomware, or wire fraud: the 2014 data breach exclusions, the electronic data exclusion, the small cyber endorsements some BOPs add, and how to check your own policy.
Cyber Insurance vs Tech E&O vs Crime Insurance: Which Do You Need?
How cyber insurance, technology errors and omissions, professional liability, and crime insurance differ, where they overlap, where wire fraud and employee theft land, and which combination fits your type of business.
Do Small Businesses Need Cyber Insurance?
A practical way to decide whether your small business needs cyber insurance: the questions that matter, what Washington breach data shows about businesses like yours, and when a small policy or no policy is reasonable.
How Much Cyber Insurance Does a Small Business Need?
A step-by-step way to choose a cyber insurance limit for a small business: count your records, estimate downtime, find your largest payment exposure, check contracts, and set sublimits and a retention that fit. With Washington breach-size data.
What Drives the Cost of Cyber Insurance (and How to Lower It)
Why cyber insurance quotes vary so much between businesses: the rating factors insurers use, the security controls that move price and eligibility most, and practical ways to lower your premium without losing the coverage that matters.
A Client Contract Requires Cyber Insurance: What the Clause Means and What to Buy
How to read the cyber insurance requirement in a client, vendor, or lease contract: limits, coverage parts, additional insured, primary and noncontributory, notice, claims-made terms, certificates, and the red-flag clauses to negotiate.
Does Cyber Insurance Cover Wire Fraud and Fake Invoices?
How cyber and crime policies treat wire fraud, fake vendor invoices, CEO impersonation, and customers paying criminals: social engineering, funds transfer fraud, and invoice manipulation coverage, sublimits, verification conditions, and what to do in the first hour.
Ransomware and Cyber Insurance: What It Pays For, Including the Ransom
What a cyber policy pays after a ransomware attack: negotiation, the ransom where lawful, forensics, restoration, lost income, breach notification, and lawsuits. Plus the sanctions rules on paying, what insurers require, and the first steps to take.
Cyber Business Interruption: When Your Systems, or Your Vendor's, Go Down
How cyber business interruption coverage works: what it pays, waiting periods, the period of restoration, dependent business interruption for cloud and software vendors, system failure, how the loss is calculated, and lessons from the Change Healthcare and CrowdStrike outages.
What to Do in the First 24 Hours After a Data Breach in Washington
A practical first-24-hours checklist for a small business after a data breach or ransomware attack in Washington: who to call, what to preserve, what not to do, how the 30-day notice clock works, and how your cyber insurance fits in.
Cyber Insurance for Dental and Medical Practices in Washington
Cyber insurance for Washington dental offices, medical clinics, therapists, and other health practices: HIPAA breach rules alongside Washington law, the My Health My Data Act, vendor outages like Change Healthcare, and the coverage features that matter most.
Cyber Insurance for Law Firms and CPA Firms in Washington
Cyber insurance for Washington law firms, CPA firms, and tax preparers: the professional rules on client data (RPC 1.6, the FTC Safeguards Rule, IRS WISP), trust account and wire fraud risk, tax season exposure, and how cyber and professional liability fit together.
Wire Fraud in Washington Real Estate Closings: Escrow, Agents, and Cyber Coverage
How closing wire fraud works in Washington real estate, who is exposed (escrow agents, brokerages, lenders, attorneys, buyers, sellers), what Washington regulators tell escrow agents, the coverage each party needs, and what to do in the first hour.

Find out what your current policies actually cover.

Send us what you have. We review it line by line against your leases and contracts, and tell you plainly what is missing. Free, and no obligation.

Get a free policy review Call (425) 537-7773