Cyber Insurance Readiness Checklist
Cyber insurance applications read like a security questionnaire. This checklist helps you gather the answers, tighten the basics an underwriter asks about and put a simple response plan in place before you compare quotes.
Why readiness comes before the quote
Most commercial applications ask what your business does. A cyber application asks how your business protects itself: how people log in, where data is backed up, who installs updates and how money leaves the bank account. Those answers shape which options an insurer puts in front of you and on what terms, and an unsure answer can stall the process.
Working through this list first has a second benefit. The steps underwriters ask about match what federal agencies recommend to small businesses anyway. CISA’s Cyber Essentials and the FTC’s small-business cybersecurity pages both start with logins, backups, updates and staff awareness, so the effort is worthwhile whether or not you buy a policy. The cyber insurance page explains what the policy itself is built to address.
Logins and access
- Turn on multifactor authentication for email, banking, payroll, cloud storage and any remote access to your network. CISA suggests starting with administrators and remote users, then extending it to everyone.
- List every user account, including those of former employees and contractors, and close the ones nobody needs.
- Give each person access only to the systems their job requires, and keep administrator rights with as few people as possible.
- Use a password manager instead of shared passwords on a sticky note or spreadsheet.
Removing a departing employee’s access on their last day is one of the simplest habits to build. Our guide to hiring your first employee covers the insurance side of onboarding; offboarding deserves its own short checklist with logins at the top.
Backups and updates
- Back up critical files and system settings automatically, and keep at least one copy offline or otherwise separated so ransomware cannot reach it.
- Test a restore. A backup nobody has tried to recover is an assumption, not a safety net.
- Turn on automatic updates for computers, phones, routers and software wherever possible.
- Replace operating systems and devices the manufacturer no longer supports.
- Keep a simple inventory of hardware, software and cloud services, with the person who manages each one.
Underwriters often ask how long the business could keep running without its systems. Thinking that through now, from the point-of-sale terminal to the scheduling software, also helps you decide how much business interruption protection to ask about in a cyber policy.
Payments, email and vendors
Fraudulent payment requests are among the most common ways small businesses lose money online. A criminal takes over or imitates an email account, then asks a bookkeeper to wire funds or change a vendor’s bank details. The FTC calls these business email imposters, and they target small offices precisely because one person often handles every payment.
- Confirm any new or changed payment instructions by calling a phone number you already have on file, never one supplied in the email.
- Have a second person sign off on wires above an amount you set.
- Set up email authentication (SPF, DKIM and DMARC) for your domain so others cannot easily send mail that appears to come from you.
- Review the security terms in your contracts with your IT provider, payment processor and cloud vendors.
Payment fraud sits where cyber and crime coverage meet. The employee theft and crime bond checklist covers the internal money controls that address the same risk from the other direction.
Helping staff spot trouble
Most incidents start with a person clicking a link, opening an attachment or trusting a convincing message. Short, regular conversations about phishing, fake invoices and tech-support scams help staff recognize them, and a culture where people feel comfortable reporting a mistake right away matters as much as any software.
Applications often ask whether employees learn about phishing and how often. Note what you already do, even if it is informal, such as a reminder at a monthly staff meeting or a practice phishing email. If you are about to add staff, fold this into the same onboarding steps as payroll and California workers’ comp.
A one-page response plan
- Who to call first: your IT provider, your bank and the insurer’s breach hotline if you have a policy.
- Where the policy number, account numbers and emergency contacts are kept offline.
- Which systems to restore first, in order.
- Who speaks to customers and staff, and who decides when to notify them.
California’s breach notification law requires a business to notify California residents whose unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person, and the Attorney General’s data breach page explains when a sample notice also goes to the state. A privacy attorney can tell you whether a particular incident triggers those steps.
Keep the plan where you can reach it if your computers are locked, such as a printed copy with your renewal papers. Look it over each year when the annual insurance review checklist already has you reviewing your policies.
What to gather for the application
- Annual revenue and the number of employees.
- The kinds of records you keep, such as customer contacts, card data, health information or bank details, and roughly how many.
- Your outside IT provider, if any, and the services it manages.
- Past incidents, even minor ones, and what changed afterward.
- Any client contract that sets a cyber or technology liability limit.
Bring those alongside the general details from the business insurance quote checklist, and ask each insurer to show the limit for every part of the policy, including any smaller limit for fraud or extortion.
A few useful answers
Common questions
Why do cyber insurers ask about multifactor authentication?
Stolen passwords are one of the most common ways into email and remote systems, and a second login step blocks many of those attempts. Turn it on before you apply and note where it is in place.
How do offline backups affect a cyber insurance application?
Underwriters look for backups that ransomware cannot reach, such as an offline or separated copy. Describe how often backups run, where copies are kept and when you last tested a restore.
What are SPF, DKIM and DMARC, and why does a cyber application mention them?
They are settings on your email domain that help receiving servers spot mail pretending to come from you. They make impersonating your business harder, which ties directly to the payment fraud questions on the application.
Is a cyber response plan worth writing for a business with two computers?
It is. A one-page list of who to call, where policy details are kept and which systems come back first is useful at any size, and it fits on a sheet stored with your renewal papers.
Who should answer the technical questions on a cyber application?
The person who actually manages your systems, whether that is an outside IT provider or a staff member. Owners often sign the form, so review the answers together to be sure they match how things run day to day.