Key takeaways

  • Ransomware supplemental forms ask about MFA on remote access and email, endpoint detection and response, and the state of your backups, including whether any are immutable and how often a restore is tested.
  • Carriers also ask about privileged access, patching and unsupported (end-of-life) systems, and whether you have a tested incident response plan.
  • Answer the form accurately. A wrong answer can create coverage trouble at claim time; talk to your broker about what the policy says on misstatements.
  • The NAIC reports that cyber premiums reached about $9.46 billion in 2025 and that many small and medium-sized businesses remain without coverage. Insurance does not prevent attacks.
  • The controls insurers ask about are the same ones CISA recommends. Fixing them improves your security and your application at the same time.

Why insurers ask so many questions

Cyber insurance exists to pay for a limited set of losses after an incident: response costs, restoration, legal help and, depending on the policy, notification and other expenses. Insurers decide whether to offer cover, and on what terms, by reading your application. That application is a security questionnaire. It reveals which controls a carrier believes make a loss less likely or smaller.

The market is large and still growing. The National Association of Insurance Commissioners (NAIC), in its 2026 Report on the Cybersecurity Insurance Market, says U.S. direct written cyber premium reached approximately $9.46 billion in 2025, up 3.5% from 2024. Domestic insurers reported 5.84 million policies in force and 56,323 claims in 2025, which is 20% more claims than in 2024. The report also says many small and medium-sized businesses remain without coverage and that only about 1% of global economic cyber losses are covered by insurance. The NAIC's own FAQ adds that insurance cannot prevent attacks, and lists employee training, access controls, software updates, backups, vendor management and a tested response plan as parts of effective cybersecurity.

Read that last point carefully. Insurance is a way to transfer part of the financial loss. It does not restore your reputation, and it will not stop a ransomware group from locking your files. The firms that get the best experience are the ones that can show they have done the basics.

What the forms actually ask: two examples

We read two published insurer documents so that this article rests on what carriers ask and not on commentary. The first is Beazley's ransomware supplemental application (form F00765, edition 05/2022). The second is Chubb's Cyber Enterprise Risk Management Extensive Cyber Proposal Form, an Australian edition published on Chubb's site. Wording, thresholds and forms differ by insurer, country, revenue band and date, so treat them as examples. Your broker will give you the current form.

1. Multifactor authentication

Beazley's form asks whether you enforce MFA for all user accounts, other than domain administrator accounts, when accessing your network remotely. It asks separately whether staff can reach web-based email such as Outlook Web Access and, if so, whether MFA is enforced there. It asks again, in its own question, whether MFA is enforced for all domain administrator accounts. Its definition of MFA is broad: it lists a call, SMS, push notification, time-based one-time password, hardware token, authenticator app, biometrics or a FIDO2 key. The form also asks whether you provide password-management software to employees and whether service-account passwords are held in a privileged access management tool or password vault.

Chubb's form goes further on privilege. It asks whether privileged access requires a separate MFA step for internal or on-network access, whether MFA is required for webmail or cloud-hosted email, and whether MFA is configured so that the compromise of any single device only compromises a single authentication factor.

What to do: turn on MFA for every user, for email, for VPN or remote access, and for every administrator account. Prefer app-based or hardware methods to SMS. Close the gaps that surveys usually find: service accounts, shared mailboxes, old protocols that skip MFA, and contractors. Our article on MFA and passkeys explains the options.

2. Endpoint protection and detection

Beazley's "Security Products and Solutions" section asks you to name the products you use: endpoint protection platform (EPP), endpoint detection and response (EDR), managed detection and response (MDR), network detection and response, SIEM and application isolation. It then asks whether you have a security operations center, whether it works business hours only or around the clock, whether it is internal or run by a third party, and whether it has the authority and ability to remediate events, such as isolating a compromised endpoint remotely.

Chubb's form asks whether you use advanced endpoint protection or EDR, and asks you to give the percentage of endpoints covered by EDR, MDR or XDR.

What to do: deploy EDR on every workstation and server, not only the executives' machines, and keep a count of coverage so you can state a real percentage. Decide who watches the alerts. A tool that fires at 2 a.m. with nobody looking is a weaker answer than a managed service with authority to isolate a device.

3. Backups

Backup questions are the most detailed on the Beazley form. It asks whether you maintain offline backups, with the choices none, partial or full. It asks whether all backups are encrypted and whether you keep an offline copy of the decryption keys. It asks whether any backup solution is immutable, defined on the form as backups that cannot be altered or deleted. It asks how often you test a restoration, with choices from never to quarterly or more often, and whether you can test backup integrity to confirm that backups are free of malware. It also asks how long you believe it would take to restore your data from the cloud.

Chubb asks how backups are protected, offering immutable or write-once-read-many storage and completely offline, air-gapped copies among the options, and it asks whether full restore tests are performed at least annually, whether you test recoverability as well as integrity, and whether the backup and restore plan includes specific ransomware scenarios.

CISA's Stop Ransomware Guide agrees on the substance. It recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario, and it explains why: many ransomware variants try to find and delete or encrypt accessible backups so that restoration is impossible unless the ransom is paid.

What to do: keep at least one copy that an administrator account on your network cannot delete, protect the backup console with its own MFA, encrypt backups, and run a documented restore test at least quarterly. Record the time it took. Our article on backups that restore covers the 3-2-1 rule and immutability.

4. Privileged access and passwords

Both forms ask who has administrative rights and how those accounts are protected. Expect questions about separate admin accounts for administrators, MFA on privileged access, and a vault for service-account passwords. Reduce the number of permanent administrators, and review the list quarterly.

5. Patching and unsupported systems

Chubb's form asks whether you have a formal patch management process, whether you assign risk levels to assets to prioritize patching, whether patches are tested before wider deployment, and what you do when a patch cannot be applied in time. It also asks you to describe any end-of-life or unsupported hardware, software or systems you operate, what they are used for, how many there are, and what other controls limit lateral movement from them. A fleet still running a product past its support date will draw questions. Our article on Windows 10 end of support explains one common example.

6. Incident response and training

Chubb asks whether you have a formal, cyber-specific incident response plan that is tested at least annually. Both carriers also ask about employee security awareness; Beazley asks about phishing training and simulations. A plan that has been exercised in a tabletop session is an honest yes. A plan nobody has read is not.

7. Email, vendors and operational technology

Longer forms ask about email filtering, domain authentication, payment verification and third-party dependencies, and manufacturers may face a separate section on operational technology, including patching cadence and compensating controls for devices that cannot be updated. The NAIC report flags third-party vendor dependencies among the risks reshaping the market.

How to answer the application honestly

Sign only what is true on the day you sign. If a control exists for most but not all of the fleet, say so and give the percentage. A statement that proves wrong after an incident can lead to disputes over the claim, and the consequences depend on the policy and on state law. Ask your broker or counsel how your policy treats misstatements. The person who signs the form should be the person who has verified the answers, with IT in the room.

Keep evidence: screenshots of MFA policies, an EDR coverage export, backup job reports and the date and result of the last restore test. Evidence shortens renewals and gives you something to show when an underwriter asks a follow-up question.

A readiness checklist

  • MFA on all users, email, remote access and every admin account; legacy protocols blocked.
  • EDR on all endpoints and servers, with a named owner for alerts and a known coverage percentage.
  • Backups with an offline or immutable copy, encryption, protected console, and a restore test in the last quarter.
  • Privileged accounts separated, minimized and vaulted; service-account passwords managed.
  • Patching process written down, with a list of unsupported systems and the controls around them.
  • Incident response plan with contacts, tested within the last year.
  • Security awareness training for all staff, including how to verify payment changes.
  • A current asset and vendor inventory.

What insurance will not do

Exclusions, sublimits, retentions and waiting periods vary by policy. Read them with your broker. Check whether the policy covers business interruption and dependent business interruption, how it treats war and infrastructure exclusions, and whether it requires you to use a panel of response vendors. Cover is a financial tool, and the controls above are what make a loss less likely in the first place.

How Clayton Cybernetics can help

Our team can walk through your current application or your broker's questionnaire, identify the answers that are weak, and fix the underlying control: MFA rollout, EDR deployment, immutable backups with scheduled restore tests, privileged access cleanup and an incident response exercise. We can produce the evidence file your broker will ask for. We do not sell insurance and we do not give coverage advice. Call (305) 404-9404 to start.

Sources

This article is general information, not insurance, legal or brokerage advice. Insurer forms change and differ by carrier, state and country; the two forms cited are examples, not a market survey. Read your own policy and ask your broker before you answer an application. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity