What Cyber Insurance Applications Ask, and How to Answer Accurately

The renewal packet arrives with a questionnaire attached. Somewhere inside, it asks whether the business requires multi-factor authentication (MFA) for all remote access, how often someone tests a restore from backup, and whether a second person confirms a vendor's change of bank details before money moves. The owner answers from memory, or forwards it to whoever handles the computers, and sends it back.

The Hartford's cyber application spells out what those answers become. The signed declaration states that the information is true and complete, that the applicant will notify the insurer immediately if anything changes before coverage takes effect, and that the application becomes the basis of the contract and is deemed attached to the policy.

How Carriers Use Those Answers Later

In April 2022, Travelers Property Casualty Company of America issued a cyber policy to International Control Services, an electronics manufacturer in Decatur, Illinois. The application asked whether the applicant required MFA for administrative or privileged access. The company answered yes, and its CEO signed the application along with the person responsible for network and information security.

Ransomware hit the company that May. Travelers alleged that MFA was not protecting the company's servers, and in July 2022 it filed suit in federal court to rescind the policy. The case never reached a ruling on the merits. That August, the two sides agreed to rescission, the court entered judgment rescinding the policy, and the case was dismissed with prejudice.

Rescission works differently from a denied claim. A denied claim leaves the policy in force and disputes one loss. A rescinded policy is treated as though it was never issued, which removes the coverage the business thought it had bought.

The City of Hamilton, Ontario shows the other mechanism. Ransomware hit the municipal network on February 25, 2024 and disrupted roughly 80 percent of it. The city refused the ransom demand and rebuilt instead, at a cost that reached 18.3 million dollars.

In July 2025, city staff told councillors that roughly 5 million dollars in insurance coverage had been denied. Public reporting from that meeting tied the denial to policy terms involving MFA that had not been fully implemented across the environment. The city later said an independent legal review found the insurer's denial consistent with the policy, and it did not pursue further legal action. The city's acting chief information officer told reporters he believed the attack would have succeeded even with MFA in place. The figures are Canadian dollars.

One case erased the policy over an application answer. The other left the policy in force and excluded the loss under a condition inside it. Policies differ, and neither case predicts what any particular policy says. What both show is the same underlying question: whether the control described on paper was running in the environment.

What the Forms Ask

Every carrier writes its own application, so the actual form your broker sends is the one your business needs to answer. The Hartford's public CyberChoice applications and ransomware supplements show the kinds of questions businesses can expect. Forms vary by account size, industry, and underwriting path, but the subject matter repeats.

• Identity and remote access. The form asks whether MFA is required for all remote access, including cloud-hosted systems, on-premises systems, and VPNs, and separately whether MFA is required for email. The ransomware supplement asks how remote access is controlled, how Remote Desktop Protocol is protected, and how a managed service provider's access to the network is controlled

• Backups and recovery. Questions cover how often critical data is backed up, whether backups sit offline or isolated from production systems, how often someone tests recovering data from them, whether an incident response or business continuity plan exists, and how often that plan is tested

• Endpoint protection and patching. The application asks where antimalware and endpoint detection run across computers, networks, and mobile devices, and names the EDR or MDR product in use. The supplement adds patch management procedure, the extent of unsupported systems still on the network, and the extent of security event monitoring and logging

• Email security and funds transfer. Beyond email filtering and external-sender tagging, the form asks whether a second method of communication confirms a vendor or partner's change of account information before a transfer goes out, and whether customer transfer requests are validated by a method other than the one used to make the request. A phone call back to a known number is the example the form gives

• Loss history and disclosure. Applicants report cyber incidents from the past three years, and applications commonly ask whether the business knows of circumstances that could give rise to a future claim. The consequences of failing to disclose one depend on the application and policy terms

Answering Without Guessing

• Ask your broker for a copy of last year's signed application before starting this year's. It shows what the business already attested to, which is the baseline a carrier would compare against a claim

• Check each system before answering. MFA enabled on email is a different answer from MFA required for all remote access, which is what the question covers

• Where the honest answer is qualified, put the qualification in an email to your broker and keep it. Many forms offer only yes or no, and the comment field, when one exists, is the place for the detail

• Have whoever administers each system confirm the answer in writing

• Keep the evidence behind each answer, dated: configuration screenshots, restore test results, patch reports

• Re-verify at every renewal. Staff, devices, and applications change during the year, and an answer that was accurate last spring may no longer describe the current setup

If You Find an Answer That Was Wrong

The Hartford's application language requires the applicant to report specified changes before coverage takes effect. Correcting an inaccurate answer promptly, rather than discovering the mismatch during a claim, gives the business and its broker a chance to address it while the stakes are lower. A correction made on a quiet Tuesday costs less than a mismatch found while a claim is open.

If a review turns up an answer that no longer holds, tell your broker promptly and in writing, close the gap it describes, and keep the record of both. Your broker and, where the stakes warrant it, your attorney can advise on what a specific policy requires.

Closing the Gaps Before Renewal

The controls on these forms overlap with what federal guidance already recommends. CISA recommends phishing-resistant MFA as the strongest available approach for account protection, particularly for privileged and remote access. The same themes repeat across that guidance: strong MFA, reliable backups and recovery, prompt patching, and security monitoring.

Starting a few months before the renewal date leaves room to put a missing control in place, run a restore test, and collect documentation, which beats answering on deadline and hoping the answer holds up later.

Know What Your Answers Will Be Before You Sign

Unfrustrating Computers helps Long Island small businesses confirm what is running on their systems before those answers get signed. That includes MFA, patching, monitoring, and tested backups, along with the documentation to support each answer.

Coverage decisions rest with your carrier and your broker. This is about making sure the answers you give them match the systems you are running.

Call 516-679-5540 or email info@unfrustratingcomputers.com to review your systems before the next renewal packet arrives.

This article is general information about technology controls and does not constitute insurance or legal advice. Consult your broker or carrier for guidance on your policy.