The renewal email shows up, and attached is a questionnaire that’s longer than last year’s. It asks whether you enforce multi-factor authentication on email, whether you run EDR, whether your backups are offline and tested, and how quickly you patch. For many small business owners, it’s the first time anyone has asked those questions in writing.
This post explains, in plain English, what those control categories mean, why insurers ask about them, and how to answer honestly with evidence behind each answer. It is not insurance or legal advice. Your broker and your policy wording decide what actually applies to you.
Why the questionnaire got longer
Insurers price risk, and the questionnaire is how they learn about yours. The questions follow the ways attacks on small businesses usually start: email, stolen passwords, missed updates, unprotected devices, and exposed remote access. Each question is really asking, “If this goes wrong, do you have a control in place?”
The questionnaire also becomes part of the record. What you sign can matter later, so treat it as a description of how your business actually runs today, not how you plan to run someday.
Multi-factor authentication (MFA)
MFA questions usually ask where it’s enforced, not just whether you have it:
- Email (for example, Microsoft 365 sign-ins)
- Remote access such as VPN or remote desktop
- Administrator and privileged accounts
- Cloud apps that hold customer or financial data
“Enabled” and “enforced” aren’t the same thing. If MFA is turned on but three staff members never enrolled, the honest answer reflects that. Fix it before renewal if you can.
Endpoint protection and EDR
Many forms now ask about endpoint detection and response (EDR) by name, and whether alerts are monitored. Traditional antivirus looks for known bad files. EDR also watches behavior on the device and can contain a threat. If you’re unsure which one you have, our explainer on EDR vs antivirus breaks it down.
Answer for every device, including the laptop that lives in a truck and the PC in the back office.
Backups and offline copies
Expect questions like these:
- Are backups automated?
- Is at least one copy off-site or offline, so ransomware can’t reach it?
- When was a restore last tested?
“We have backups” only counts as an answer if you can prove a restore. Test restores, and run a ransomware tabletop drill to produce exactly the evidence an underwriter wants to see. Our off-site backup and disaster recovery page covers how we set this up.
Patching
Patching questions ask how quickly you apply critical updates to operating systems and key software, and whether any systems are unsupported. Windows 10 PCs without Extended Security Updates fall into that category. See our guide on Windows 10 Extended Security Updates.
Email security and training
Email is where most attacks on small businesses begin, so expect questions about:
- Filtering for phishing and malicious attachments
- Email authentication on your domain (SPF, DKIM, DMARC). See email authentication for SMBs
- Security awareness training for staff
- A callback process for payment or bank-detail changes
Documenting answers honestly
The most useful habit: answer only what’s true today, and keep evidence for each answer. A short internal file might hold:
- A screenshot or report showing MFA enforcement
- The list of devices with endpoint protection and when they last checked in
- Backup job history and the date of your last test restore
- Patch status reports
- Training completion records
If an answer is “partially,” say so and note the plan. A misstatement on an application can become a problem at claim time. Your broker can explain how that works under your specific policy.
Before renewal
Start four to six weeks before your renewal date if you can:
- Get the questionnaire from your broker early.
- Go through it with whoever manages your IT, and mark each answer yes, no, or partial.
- Close quick gaps first (MFA enrollment usually comes before everything else).
- Gather the evidence for each answer.
- Give your broker an honest, documented form.
FAQ
Do all cyber insurers ask the same questions?
No. Forms differ, but most cover MFA, endpoint protection, backups, patching, and email security.
Can my IT provider fill out the questionnaire for us?
They can help gather facts and evidence. The business still signs it, so review every answer yourself.
Will fixing these controls lower my premium?
We can’t promise that. Pricing is up to the insurer. Strong controls do make the questionnaire easier to answer truthfully.
Get ready before your renewal
AEH Solutions can review your controls and evidence ahead of your renewal with a free IT assessment, covering security posture, backups, Microsoft 365 configuration, and patch status. Learn more about our cybersecurity services or call (210) 721-5080.
AEH Solutions · 4333 State Highway 16 S, STE 100, Bandera, TX 78003 · (210) 721-5080