A renewal form lands in your inbox. The deadline is close. You ask the office manager to fill it out, or forward it to your insurance broker.
Then come the questions: Is MFA enforced for every user? Does endpoint detection cover all devices? Have you tested restoring your backups?
These aren’t just administrative details. Your answers can influence underwriting and, depending on your policy language and applicable law, may become important if you later make a claim.
For a law firm, medical practice, accounting firm, or financial advisory business, a cyber insurance renewal is now one of the most consequential IT reviews of the year. The safest approach is to verify your controls before anyone signs the application.
Why a Cyber Insurance Questionnaire Deserves Your Attention
Insurers are asking more specific questions about how your systems are protected, not simply whether cybersecurity matters to you. Current applications and supplements may ask about controls such as MFA, endpoint protection, and other security practices. For example, Travelers publishes separate cyber renewal applications and an MFA supplement.
That makes renewal a practical IT audit: an opportunity to compare what the application asks with what is actually configured, deployed, and maintained across your firm.
The risk is not just getting a less favorable underwriting decision. If an application contains a material inaccuracy, it can become a coverage issue. Whether a particular answer affects a claim depends on the policy, the application, and applicable law. But discovering a mismatch after an incident, when you are trying to restore operations and notify clients, is far worse than finding it during renewal.
And inaccuracies are often unintentional. The person completing the form may be a partner, office manager, or broker who does not have access to the Microsoft 365 tenant, endpoint security console, or backup reports.
“Hey Margaret, do we have MFA?” is not a technical assessment. Margaret may know that users see an MFA prompt sometimes. She may not know whether a legacy email protocol bypasses the requirement, or whether an administrator account is excluded.
“We Have MFA” May Not Mean MFA Is Enforced
MFA, multifactor authentication, requires more than a password to verify a login. It can help prevent unauthorized access even when a password is compromised. But “available” is not the same as “required.”
Exceptions can hide in the details:
- Legacy protocols or third-party applications that still allow basic authentication.
- Service accounts that are excluded from standard sign-in policies.
- Break-glass accounts intended for emergencies but not reviewed or protected appropriately.
- Administrator accounts without strong, phishing-resistant authentication.
- Remote access, email, or cloud services with different rules.
A firm may have MFA enabled for most employees and still be unable to accurately answer “yes” to a question about all users or all remote access. Your IT assessment should establish exactly which accounts and systems are covered, identify exceptions, and document how those exceptions are controlled.
The Controls Insurers Commonly Ask About
The wording varies by carrier, policy, and application. Read your own form carefully and ask your broker to clarify anything unclear. In plain language, prepare to discuss:
- Enforced MFA: Is it required for relevant accounts and access paths, not merely offered?
- Endpoint detection and response (EDR): Is advanced endpoint security installed and actively monitoring all covered laptops, desktops, and servers?
- Email security: Are filtering and protection tools helping block phishing, malicious attachments, and suspicious links?
- Backups and recovery: Are backups protected, and have you tested restoring data? What is your documented recovery time for critical systems?
- Incident response: Is there a written plan, and does it name the people and vendors to contact if an incident occurs?
- Privileged access: Are administrator accounts limited, protected, and reviewed? Do employees use separate everyday and administrative accounts where appropriate?
- Patch management: Are operating systems and applications updated on a defined schedule, including servers and less-visible devices?
- Security awareness training: Do staff receive training on phishing, credential theft, and safe handling of sensitive information?
- Network segmentation: Are critical systems separated where appropriate, limiting how far an intruder or malware can move?
- Written policies and asset records: Can you show documented security practices and a current inventory of devices and systems?
These controls are related. Strong endpoint security cannot compensate for untested backups. A written incident plan is less useful if it lists people who have left the firm. Good cybersecurity is a managed process, not a collection of checkboxes.
Partial Coverage Can Turn “Yes” Into “No”
One unmanaged laptop. One old server left out of backup. One administrator account with a different login policy.
Those exceptions can matter. If a question asks whether every device is protected or all critical systems are backed up, strong coverage for most of your environment may not support an unqualified “yes.” Your IT asset management process should help you identify what is in scope, including equipment that is remote, rarely used, or easy to overlook.
The same is true of backups. A job that reports “successful” proves that data was copied; it does not prove that your firm can restore it quickly enough to resume work. For a law firm, a medical practice, or an accounting firm, recovery delays can disrupt client service, patient care, financial reporting, and regulatory responsibilities.
Test restores, record the results, and identify recovery priorities. That is how backup becomes ransomware protection and business continuity planning, not merely a storage task.
A Practical Renewal Plan: Five Steps Before You Sign
- Find the current policy and last application. Compare the new questions with the answers you submitted previously. Flag changed controls, changes in your business, and anything you cannot verify.
- Get an IT assessment against the actual questionnaire. Ask the person responsible for your systems to check the specific accounts, devices, applications, and services named in the form, not just provide a general security overview.
- Close gaps before renewal where possible. Prioritize exposed accounts, unprotected devices, incomplete endpoint security, untested backups, and outdated systems. If you cannot close a gap in time, document it and discuss an accurate response with your broker.
- Keep evidence. Save dated reports or records showing MFA scope, endpoint coverage, backup and restore-test results, patching, training, incident-response contacts, and relevant policies. Evidence makes renewal more reliable and gives you a useful baseline for ongoing improvement.
- Answer precisely, then review. Distinguish between “available,” “deployed,” “enforced,” and “tested.” Disclose exceptions rather than assuming they do not count. Retain the final application and supporting documentation.
If you discover an inaccurate answer in a prior application, do not guess at the remedy. Contact your broker and, where appropriate, qualified legal counsel to understand the right next step.
Should You Handle It Internally or Use a Managed Services Provider?
There are advantages to doing the work with internal staff. They know your processes, can coordinate quickly, and may be able to verify controls if they have the right access and expertise. The trade-offs: technical assessment takes time, the documentation burden can be substantial, and staff turnover can leave gaps in institutional knowledge.
A managed services provider (MSP) can bring broader experience across security tools, Microsoft 365, endpoint security, backup, and recovery. A capable partner can help perform the assessment, coordinate remediation, and maintain evidence as your environment changes. That support can be valuable for firms without internal IT leadership, but it is not a substitute for your own review of the application or a discussion with your broker.
“I got a guy” may be a good start. It is not an evidence process. Whether you use outsourced IT, business IT support, or internal staff, assign clear ownership for every answer and keep a record of how it was verified. This is especially important for law firm cybersecurity, medical practice IT, and accounting firm IT, where sensitive client, patient, and financial information demands careful handling. Depending on your services and obligations, your review may also connect to HIPAA compliance or other applicable requirements.
Final Word
Your cyber insurance application is not a form to complete by memory or assumption. It is a chance to check whether your protections work across your real environment, and whether your documentation supports the answers you are signing.
Start before the renewal deadline. Verify the controls. Document the exceptions. Coordinate with your broker. If you need help translating insurance questions into a practical IT assessment, A PC of Mind can help you evaluate your environment and plan next steps.
Requirements vary by carrier, policy, and state. Read your own application and consult your broker about coverage questions. This article is general information, not legal or insurance advice.
