Cyber Insurance Renewal: What Carriers Ask For Now

The renewal questionnaire shows up earlier every year, and it is longer. Five years ago it asked whether you had antivirus. Now it asks how quickly you patch, where your backups live, whether the backups have been tested, and who has administrator access.

Carriers are not being difficult. They lost money, and they adjusted. The result is that a cyber policy now works a bit like a safety inspection. You can answer the questions honestly on your own, or you can have someone help you get the answers first.

Here is what comes up most often, and what to have ready.

1. Multi-Factor Authentication, Everywhere

Not email only. Remote access, the accounting system, the client database, the administrator accounts, and anything that can be reached from the internet. The questionnaire usually asks whether MFA is required, not available. "Available" gets marked as no.

Have a dated screenshot or a report from your provider showing that MFA is enforced for all users and all remote logins. A policy that says it should be is not proof that it is.

2. Endpoint Protection That Is Actually Managed

Traditional antivirus is no longer the answer carriers look for. They ask about endpoint detection and response, usually shortened to EDR, and whether someone watches the alerts. A tool installed and forgotten is a common gap, and it is easy for an underwriter to spot because the same answer appears in every breach report.

3. Tested Backups, Not Just Backups

Carriers ask how often backups run, where the copies live, whether one copy is offline or immutable, and when the last restore test happened. That last question is where businesses get stuck, because many have never tested.

If backup has never been restored in a test, say so and fix it before renewal. Our backup and disaster recovery service runs a restore test on a schedule and produces a record you can hand to a carrier.

4. Patch and Update Timing

How fast do critical updates get applied? Thirty days is a common benchmark, and a week or less is better for internet-facing systems. The carrier is checking whether you have a process, not whether you have a slogan.

5. Email Filtering and Phishing Training

Most claims still start with an email. The questionnaire asks whether inbound mail is filtered and whether employees receive security awareness training. Training that happened once in 2022 does not count. Carriers like a recurring program with completion records.

6. Remote Access Controls

How do people get in from outside the office? A VPN with MFA is the answer carriers want. A remote desktop port open to the internet is the answer that causes problems, and it is more common than it should be.

7. An Incident Response Plan

Not a binder. A one-page plan that says who calls whom, who talks to the lawyer, who talks to the carrier, and how the business keeps running for the first 48 hours. If a claim happens, the carrier will ask whether you followed a plan. Having one is worth more than a longer policy with a lower deductible.

8. Privileged Access

Who has administrator rights, and how many of them still work at the company? Carriers increasingly ask for a list and a review process. This is where onboarding and offboarding meet insurance, and where small businesses are most likely to be surprised by their own answer.

The Part Nobody Warns You About

Most questionnaires end with a signature. You are attesting that the answers are true. If an incident happens and the carrier finds that the answer was optimistic, the claim can be reduced or denied.

That is the real reason to prepare. Not to get a better price, though a complete application often does. It is so your answers match what is actually running in the office, on the day the form is signed and the day something goes wrong.

Start 60 to 90 Days Before Renewal

The work is mostly verification. Pull the inventory, the patch report, the MFA report, the backup test log and the training records. If a report does not exist, that is your list of projects for the next two months.

A provider of cybersecurity services in Central PA usually keeps these records as part of normal monitoring, which turns the questionnaire into a retrieval job instead of a scramble. If you run your own systems, a provider of managed IT services in Central PA can still assemble the evidence and run the restore test.

What to Do This Month

Find out when your policy renews. Put a reminder 90 days before that date. Then start collecting the eight answers above. If any of them is a no, you have a project with a deadline, which is better than a surprise at renewal.

If you would like help getting ready, call BlackCSI at (717) 620-3042 or get in touch. We will go through the questionnaire with you and tell you which answers need work before you sign.