Why your cyber insurance application keeps getting queried

The questionnaire got longer for a reason

Insurers pay out on ransomware and business email compromise often enough now that the underwriting questionnaire has grown teeth. Where a renewal used to be a formality, it increasingly asks for specifics: is multi-factor authentication enforced everywhere, not just on the systems it is convenient to enable it on; are backups tested, not just scheduled; is there a written, rehearsed incident response plan, not just an assumption that someone would know what to do.

A queried application is usually not a sign the business is uninsurable. It is a sign the honest answer to one of those questions is "partially," and nobody had gathered the evidence to say more than that.

The gap between "we have it" and "we can show it"

The businesses that sail through renewal are not necessarily more secure than the ones that get queried. They are the ones who can point to evidence: a log showing MFA is enforced account-wide, a record of the last successful backup restore test, a document an employee could actually follow during an incident rather than one that exists to satisfy an auditor.

That distinction — having a control versus being able to evidence it — is exactly what an underwriter is testing for, because a control nobody can demonstrate is a control that may not survive contact with an actual incident.

Where to start

Before the next renewal, it is worth an honest pass across access control, backups, endpoints and the paperwork that ties them together — the same four areas any competent audit would check — specifically looking for the difference between what is genuinely in place and what would need to be built if an underwriter, or an incident, asked for proof tomorrow.