Are there fixed requirements for every cyber insurance policy?
No. Insurers and products have different acceptance rules. Company size, industry, data, IT dependency, the cover you want and current market conditions all influence which questions are asked and which evidence is required. Individual security measures guarantee neither acceptance nor a discount nor cover.
Complete and up-to-date answers are nonetheless essential: incorrect or incomplete information can affect the quotation, the contract and the later assessment of a claim.
Information you should prepare
Company and desired protection
- business activity, locations, revenue and number of employees
- key customer groups and regulated activities
- desired coverage modules, limits and deductibles
- previous cyber incidents, losses and known current circumstances
Data and digital dependencies
- types and approximate volumes of personal and business data processed
- critical systems, cloud services and external IT service providers
- maximum tolerable downtime for important processes
- dependencies on individual suppliers or platforms
Identities and access
- multi-factor authentication for email, remote access and administrator accounts
- management of privileged rights and leavers
- protection of publicly accessible services and remote maintenance
- procedures for suspicious accounts or compromised credentials
Updates, protection and monitoring
- responsibilities and deadlines for security-relevant updates
- vulnerability management for internet-facing systems
- endpoint protection, logging and alert handling
- handling of software that is no longer supported
Backups and recovery
- separation or immutability of backups
- protection of backup administrator accounts
- date and result of the last restore test
- documented sequence for restarting critical systems
Incident response and legal
- internal incident plan with roles and contact channels
- access to IT forensics, legal advice and communication support
- process for assessing notifications to the FDPIC, the NCSC, supervisory authorities or affected persons
- exercises and lessons learned from past incidents
Which evidence is helpful?
Not every insurer asks for the same documents. In practice, the following can be helpful:
- an up-to-date inventory of systems and service providers;
- a screenshot or configuration evidence of MFA for critical access;
- a record of a backup restore;
- a patch or vulnerability report with processing status;
- the incident plan and the record of the last exercise;
- relevant certificates or audit reports, with documented open items.
A certificate does not replace a complete description of your risks. Conversely, a company should only share sensitive technical details through a dedicated, protected channel.
Common mistakes in the cyber questionnaire
- Answers are estimated: IT, management, data protection and external service providers should clarify disputed points together.
- “Yes” is interpreted too broadly: MFA for some users is not the same as MFA for all critical and privileged access.
- Backups are confused with recovery: what matters is whether restoring has actually been tested.
- Known incidents are left out: circumstances that have not yet been quantified or investigated can also be relevant.
- Answers become outdated before the policy starts: material changes between the questionnaire and conclusion of the contract should be reported.
- Quotations are based on different information: a comparison is only reliable if the risk data and desired cover are identical.
Before submitting: a quick check
- Are all answers dated and owned by someone internally?
- Have unclear terms been clarified with the insurer or broker?
- Do the answers match the technical evidence?
- Are exceptions, legacy systems and ongoing improvements described openly?
- Have cover, sublimits, deductible and exclusions been reviewed separately?
The completed questionnaire is part of the basis for the decision. Keep the submitted version and the related evidence on file in a traceable way.