Your Cyber Insurance Renewal Is Really an IT Audit: Here's How to Pass It

December 1st, 2026

Every year the renewal arrives, and every year the questionnaire is longer. MFA on email, yes or no. Endpoint detection and response, yes or no. Immutable backups, yes or no. Tested restore, yes or no. What used to be a page of basic questions is now a forty item security assessment, and the insurer is not asking out of curiosity.

Cyber insurers lost money for several years and changed how they underwrite. They now price on controls, not on revenue. That means your renewal is an audit. The answers you give become part of the contract, and in many policies a material misstatement is grounds to deny a claim. Answering "yes" to something you have not actually implemented is worse than answering "no."

The Questionnaire Is a Contract, Not a Survey

Most applications carry a signature block or an attestation clause. When you sign it, you are representing that the controls described are in place on the day you signed and, in many forms, will remain in place during the policy period. If a breach later shows the representation was false, the insurer can rescind coverage or deny the claim.

This is where small businesses get hurt. The person filling out the form is often the office manager or the owner, working from memory, with the IT provider never consulted. The answer "we have MFA" gets checked because email has MFA. Nobody notices that the VPN, the server admin account, and the line of business application do not.

A claim denial does not arrive in year one. It arrives after a ransomware event, when the business is already down and the forensic report shows the gap.

What Insurers Actually Score

Questionnaires vary by carrier, but the same ten controls show up almost everywhere. Each one is worth understanding before you attest to it.

• Multi factor authentication. Insurers now ask where it is enforced, not whether it exists. The expected answer is everywhere: email, remote access, privileged accounts, cloud administration, and any application holding sensitive data.
• Endpoint detection and response. Traditional antivirus is signature based and no longer sufficient. Insurers want an EDR tool that is deployed and monitored, with someone responding to the alerts.
• Backups. The questions are specific. Are backups encrypted, are they kept offline or immutable, how often, how long is retention, and when was a restore last tested. That last question is where most applications fail.
• Privileged access. Who has administrator rights, is that list reviewed, are admin accounts separate from daily use accounts, and is there a record of privileged activity.
• Patch management. Not "do you patch" but "how often, and can you show the report." A documented monthly cycle with evidence beats a vague claim of best effort.
• Remote access. Insurers specifically hunt for exposed RDP and unmanaged VPN appliances. Remote desktop open to the internet is close to an automatic declination.
• Email security. Filtering, phishing resistant authentication for the domain, and some form of user training with recorded completion.
• Segmentation. Whether the finance system, the phone system, the cameras, and the guest network all sit in one flat network. Flat networks turn a single compromised device into an enterprise incident.
• Incident response. A written plan with named roles, a call tree, and a decision about who talks to counsel. Many carriers ask whether the plan has been exercised.
• Monitoring and logging. Whether logs exist, how long they are retained, and whether anyone reviews them. Ninety days is a common expectation.

Where Applications Fall Apart

The failures are predictable, and they have little to do with whether a business takes security seriously.

• MFA on email only. The most common gap. The owner says yes because Outlook prompts, and the VPN still takes a password alone.
• Backups that were never restored. The job reports success, the drive fills up, and nobody has tried to recover a file since installation.
• No asset inventory. The form asks how many endpoints and servers are covered. If the answer is a guess, the answers built on it are guesses too.
• Plans that exist as a PDF. A disaster recovery document written three years ago, naming a vendor who is no longer used, is not a plan.
• Vendor assumptions. The application vendor, the phone provider, and the camera installer each assumed someone else covered patching or monitoring. Usually nobody did.
• Answering aspirationally. Ticking a box because the control is "in progress" or "planned for next quarter." A questionnaire asks about the present tense.

None of these require a sophisticated attacker. They require a form filled out by someone who was not given the facts.

Build the Evidence File Before the Renewal

The difference between passing and scrambling is documentation that already exists. A short evidence file, kept current, turns a two week panic into an afternoon.

1. Asset inventory. Every server, workstation, network device, and cloud service, with owner and operating system.
2. MFA enforcement screenshot. Per system, showing the policy setting, not just a login prompt.
3. EDR deployment report. Agent coverage by device, with the gaps named.
4. Backup configuration and restore test log. The schedule, the retention, the immutability setting, and the date of the last successful full restore.
5. Patch compliance report. A screenshot from the patch tool is stronger than a description of the process.
6. Privileged account list. Named administrators, with the review date.
7. Incident response plan. The current version, with the call tree and the last tabletop exercise date.
8. Security awareness training records. Completion rates by employee, not a statement that training is provided.
9. Network diagram. Showing segmentation between business systems, voice, cameras, guest access, and any operational technology.

If an item cannot be produced, that is the finding. It is better to discover it in October than to attest to it in December and explain it to a claims adjuster in March.

A 90 Day Sequence

If the renewal is close and the gaps are real, work in the order insurers weigh most heavily:

1. Close the exposed remote access. Remove direct RDP exposure and put MFA in front of the VPN and any remote management tool. This is the single biggest underwriting factor.
2. Extend MFA to privileged and cloud accounts. Email is done. The gap is the admin side.
3. Confirm backups are immutable and run one full restore test. Keep the result. It answers the question that most often triggers a denial.
4. Deploy or verify EDR coverage. Name the devices that are uncovered and why.
5. Produce the patch and asset reports. Even an imperfect report is credible; no report is not.
6. Update the incident response plan and exercise it once. A one hour tabletop with the leadership team counts, and it produces a record.
7. Send the finalized answers to your IT provider before signing. Every control statement should be one they can defend in a claim.

Then keep the file. Renewal comes again in twelve months, and the carrier will ask about the controls you attested to. If the company added remote workers or a new cloud application in the meantime, the answers change.

When the Honest Answer Is No

Sometimes a control is genuinely not in place. Say so. Then describe the compensating control and the remediation date. Insurers routinely accept "MFA is enforced on remote access and email; the legacy accounting application does not support it, and it is scheduled for replacement by Q2 with network restrictions in the interim." What they do not accept is a false affirmative discovered after a loss.

Talk to your broker about warranty wording as well. Some policies include a signed warranty that specific controls are in place, and breach of warranty can void coverage entirely. That language is worth reading before the form is signed, not after.

The Renewal Is a Useful Deadline

The uncomfortable part of the process is that it forces a business to state, in writing, what its security actually looks like. That is the same exercise a good IT provider does every quarter. Businesses that treat the renewal as an annual paperwork chore tend to discover the gaps through a claim. Businesses that treat it as an audit tend to fix them before anyone asks.

Voice & Data Systems helps Omaha area businesses prepare for cyber insurance renewals with documented managed IT services and IT support, from MFA rollout and EDR coverage to backup restore testing and incident response planning. If your renewal is coming up and you are not sure the answers are defensible, contact us to review the controls before you sign.