Help With Your Cyber Insurance Application
Most cyber insurance questionnaires are written for IT people, and a wrong "yes" can cost you a claim. We go through yours with you, question by question, check what is really in place, fix the gaps, and prepare the evidence your insurer asks for. You or your broker submit it, with the IT answers matching what is actually in place.
Why the form is so hard
- A typical application runs from fifty to two hundred questions, written in security terms most owners never use.
- Many questions say "all" or "every": all users, all devices, every remote connection. One exception can make the honest answer "no".
- The answers become part of your policy. If they do not match what was in place when an incident happens, the insurer can dispute the claim.
- Renewals ask for more each year, and increasingly ask for evidence, not just ticked boxes.
What the questions mean, in plain English
Every insurer words its form differently, but most ask some version of these.
Is multi-factor authentication (MFA) enforced for email, remote access, and privileged accounts?
What it means: Does every sign-in need a second step, such as a code from a phone app, with no exceptions? Shared mailboxes, service accounts, and old admin accounts count. Text message codes are increasingly not accepted.
Do you use endpoint detection and response (EDR) on all endpoints?
What it means: Regular antivirus is often no longer enough. EDR watches how programs behave on each computer and can stop an attack in progress. Microsoft Defender for Endpoint, SentinelOne, and CrowdStrike are examples. "All endpoints" means every laptop, desktop, and server.
Are privileged accounts separate from everyday user accounts?
What it means: Whoever manages your systems should use a separate admin account for admin work, not the same account they read email with.
Are backups segregated, immutable, or offline, and are they tested?
What it means: Do you have a copy of your data that an attacker on your network could not delete or encrypt, and have you actually restored from it to prove it works? Microsoft 365 email and files need their own backup, because the built-in retention in Microsoft 365 is not a backup.
Is DMARC enforced (quarantine or reject) on your email domains?
What it means: An email setting that tells other mail systems to quarantine or reject messages that fake your domain. "Monitor only" usually does not count as enforced.
Do you have email filtering and impersonation protection?
What it means: Does your email system block phishing and flag messages pretending to be your owner, managers, or finance staff?
How often do staff receive security awareness training and phishing simulations?
What it means: Insurers want dated records showing everyone was trained, at least once a year and increasingly quarterly, plus test phishing emails and the results.
Do you verify requests to change payment or banking details?
What it means: When a supplier emails new bank details, does someone confirm by phone using a number you already had, not one from the email? This is about invoice and payment fraud.
How quickly are critical security updates applied?
What it means: How many days it takes to install important updates on computers, servers, and firewalls, and what you do about machines that cannot be updated.
Is remote desktop (RDP) exposed to the internet? How do staff connect remotely?
What it means: Can anyone on the internet reach a sign-in screen for your computers? The expected answer is no. Remote access should go through a VPN or a secure gateway, with MFA.
Do you have a written incident response plan, and when was it last tested?
What it means: A short document saying who does what in the first hour of an attack, who to call, and how you would keep working. "Tested" usually means a tabletop walk-through in the last 12 months.
How many records of personal information do you hold, and have you had any incidents?
What it means: Roughly how many customer, patient, or employee records you store, and any security incidents in the past few years with what you did about them. Insurers ask this to understand the risk, not to catch you out.
For the full list of controls and the documents underwriters ask for, see what documentation cyber insurers ask for in our cyber insurance guide.
How we help
Free IT assessment
Send us the questionnaire and your deadline. We look at how your systems are set up today and tell you what is ready and what is not.
Go through it together
We sit down with you, in person or online, and explain each question so you know exactly what it is asking.
Fix the gaps first
We close the gaps that matter most before you answer, usually MFA, EDR, backups, and email security, so your answers can be accurate.
Prepare the evidence
Screenshots, reports, policies, and training records, ready for when the insurer asks for proof.
Keep it current
At renewal we update your answers and evidence, so next year starts from this year.
New applications
First-time cyber cover, or a client contract that now requires it.
Renewals
A longer questionnaire than last year, or new questions you have not seen before.
Declined or restricted
Ask your broker why, then we fix the controls behind it before you apply again.
We handle the IT side, your broker handles the policy
ClayGen is not an insurer or a broker. We do not sell policies, quote premiums, or recommend insurers. We make sure the security answers on your application are accurate and backed by evidence, and we are happy to work directly with your broker on the technical questions.
The controls insurers ask for are the same ones that keep you safe. If you want them run for you on an ongoing basis, that is our managed cybersecurity service.
Want a quick read on where you stand first? Our free cyber insurance readiness check scores you against the controls Canadian insurers ask about, in a few minutes and with no email required. For what policies cover and what drives the cost, read cyber insurance in Canada.
Cyber Insurance Application Help FAQ
Can ClayGen help me fill out my cyber insurance application?
Does ClayGen sell cyber insurance?
What happens if I answer a question wrong?
What if we do not have some of the controls the form asks about?
What should I send ClayGen to get started?
Can ClayGen help with the renewal questionnaire every year?
Send us the form
Tell us your deadline and send the questionnaire. We will tell you what is ready, what needs fixing, and what evidence you will need.
Book a Free IT AssessmentLast updated . Page created: help completing cyber insurance applications and renewal questionnaires, with common questions explained in plain English.