The business itself
Expect revenue, employee count, industry, locations and a description of operations, then the kinds and number of records held: Social Security numbers, bank and card details, health information. These set the scale of a breach-response exposure and point the underwriter toward the losses most likely for that kind of business.
You will also be asked about prior incidents and claims, and about any known circumstance that could lead to one. Answer completely; an undisclosed known incident can create serious coverage problems later.
Access and identity controls
Multi-factor authentication is usually the first control question: whether it protects email, remote access, privileged administrator accounts and cloud services. Some carriers treat it as a threshold item. Related questions cover how administrator rights are limited and how quickly a departing employee's access is removed.
NIST's Cybersecurity Framework 2.0, released in February 2024, and CISA's guidance for small and medium businesses describe these controls in plain terms for owners without a security team.
Backups, endpoints and patching
Underwriters ask how backups are made, whether they are separated from the main network or kept offline, and when a restore was last tested. They ask whether endpoint detection and response runs on computers and servers, how quickly critical updates are applied, and whether email is filtered for malicious links and attachments.
These questions track ransomware, the loss that most often turns a cyber incident into a long outage.
Payments and fraud controls
If the policy will include social-engineering coverage, expect questions about payment controls: whether changes to vendor or payroll bank details are confirmed by calling a number already on file, whether payments above a threshold need a second approval, and whether employees receive phishing training. Some coverage is conditioned on following the procedure you describe.
Answer what is actually done, not what is planned. If a control is missing, it is usually better to put it in place before the application goes out. Contractors can see the full submission list on the construction cyber liability insurance quote page, and anyone weighing premium can read what cyber insurance costs.
More on Cyber & Technology Risk
Cyber Insurance vs. General Liability: Where One Stops and the Other Starts
General liability answers for injury and property damage; cyber insurance answers for data, networks and money moved on false instructions. Here is where the line usually falls.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
When a Contract Requires Cyber Insurance: What to Check Before You Sign
More owners, general contractors, lenders and agencies now write cyber insurance into their agreements. Here is how to read the requirement before it becomes a condition you cannot meet.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Wire Fraud and Payment Diversion: Cyber Insurance, Crime Insurance, or Both?
A redirected payment is the most common cyber-related loss for many businesses, and the one most likely to fall between policies. Here is how cyber and crime forms divide it.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Frequently asked questions
What questions are on a cyber insurance application?
Business size and records held, multi-factor authentication, backups and restore testing, endpoint protection, patching, email filtering, payment-change procedures, phishing training and prior incidents.
Do I need multi-factor authentication to get cyber insurance?
Many carriers ask about it first, and some treat it as a threshold item for email and remote access. A missing control can narrow the terms offered or the number of carriers willing to quote.
What happens if my application answers are wrong?
Inaccurate or incomplete answers, especially about known incidents or controls, can create serious coverage problems after a loss. Answer with what is actually in place.
Why do underwriters ask about backups?
Separated, tested backups let a business recover from ransomware without relying on an attacker, which shortens outages and reduces losses.
Should I improve controls before applying?
Usually, yes. Putting multi-factor authentication and tested backups in place before the submission goes out often improves both terms and the number of carriers willing to quote.