Why the questionnaire matters
Cyber insurance usually covers costs after an attack or data breach: investigation, recovery, legal help and sometimes business interruption. The insurer wants to know the risk up front. That is why taking out or renewing a policy almost always comes with a questionnaire about your IT security.
In many SMEs that list is filled in quickly by the managing director or the office manager. That is understandable, because the questions are technical. But the answers are not a formality. The insurer bases cover and premium on them. If after an attack it turns out that a measure you ticked was not there, the claim can become difficult. So also read what your policy says about the accuracy of the information you provide.
What insurers usually ask
The exact questions differ per insurer, but the same topics keep coming back:
- Multi-factor authentication (MFA) on email, on remote access such as VPN or remote desktop, and on admin accounts. Watch the word ‘all’: one old account without MFA already makes the answer untrue. And legacy authentication can bypass MFA.
- Backups: how often they run, whether there is a copy an attacker cannot delete or encrypt, and whether restores are tested. Also whether you back up Microsoft 365 itself, because cloud is not a backup.
- Updates: within how many days critical security updates are installed, and whether any systems still run that no longer receive updates. How to organise that is covered under patch management.
- Device protection: managed antivirus or EDR on laptops and servers, and whether staff have local admin rights.
- People and processes: security awareness training, a check on payment requests and a plan for what you do in an incident.
Step 1: have every question checked, not answered on instinct
Give the questionnaire to whoever manages your IT, in-house or external. Ask per question: is this true for all accounts, all devices and all locations? Many answers can be verified in Microsoft 365 and in the management tools. The MFA overview shows which accounts still lack a second step. The backup software shows when the last successful backup and the last restore test took place.
Keep the evidence with the questionnaire: an export, a report or a dated screenshot. That helps at the next renewal, and if questions come up after an incident.
Step 2: fix what is missing before the start date
The check often shows that most things are fine and a few are not. A shared mailbox that people still sign in to with a password. An old service account without MFA. A backup that runs, but sits on the same server as the data. Points like these can usually be fixed within a few weeks. Plan that before the renewal, or agree with your broker how to report a measure that is still being implemented.
Step 3: keep it current
A questionnaire is a snapshot. A new employee without MFA, a laptop that has not had updates for months or a backup that quietly fails, and the answer is no longer true. So agree that the measures from the questionnaire are checked regularly, for example every quarter. Many of the same points show up in the Microsoft 365 Secure Score and in customer requirements under NIS2.
Also know what to do if something does go wrong. Many policies have an incident line you call first, before you start recovering yourself. Put that number in your incident plan, next to the steps for a compromised account.
What Floor ICT does
Floor ICT goes through your insurer’s questionnaire with you and checks, question by question, how your environment is actually set up. You get an overview with the evidence per measure and a list of what is still missing. After your approval we fix those points, such as MFA for the last accounts, a backup that is separate from the network or update management on all devices. As your MSP, we keep those measures in place afterwards, so the next questionnaire holds no surprises. We do not give insurance advice: which policy you choose and what you sign is something you discuss with your broker and decide yourself.