Guide
Cyber Insurance Requirements Checklist for Financial Firms
Carriers now ask detailed security questions before they write or renew a cyber policy. Here are the controls they look for and how to answer the application accurately.
Key takeaways
- Most carriers expect multi-factor authentication, endpoint detection and response, tested backups and security training before they quote.
- Application answers matter: an inaccurate answer can affect coverage when you need to make a claim.
- Missing controls can mean higher premiums, lower limits, exclusions or a declined application.
- Start reviewing controls well before your renewal date so there is time to close gaps.
Why it matters
Why carriers ask so many questions
Ransomware, business email compromise and wire fraud have made cyber claims expensive, and financial firms are frequent targets. Carriers now underwrite on specific technical controls rather than general statements, and many ask for evidence. The answers on your application become part of the policy, so they need to describe what your firm actually has in place.
Checklist
Controls carriers commonly expect
- Multi-factor authentication on email, remote access, cloud applications and every administrator account.
- Endpoint detection and response on all workstations and servers, monitored so alerts are acted on.
- Backups that are encrypted, kept separate from your network or immutable, and restored in a test at least once a year.
- Email security that filters phishing, malicious attachments and impersonation attempts.
- Patch management with critical updates applied quickly and no unsupported operating systems in use.
- Security awareness training and phishing simulations for all staff.
- Privileged access controls: separate administrator accounts and no daily work with administrator rights.
- Incident response plan, written and tested, including who calls the carrier’s breach hotline first.
- Wire transfer procedures that require call-back verification before changing payment instructions.
- Encryption of laptops and of sensitive data in email and file sharing.
- Vendor management: knowing which vendors hold client data and how they protect it.
- Logging and monitoring so you can tell what happened during an incident.
The application
How to answer the application accurately
- Answer for the whole firm, not just the main office: every user, device and remote worker.
- Do not answer yes to a control that is only partly in place; describe the gap and the date it will be closed.
- Keep evidence, such as MFA reports, backup test results and training records, with the application.
- Have your IT provider review technical answers before they are submitted.
- Tell your broker about material changes during the policy period, such as a new office or a new system.
Insurers have sought to deny claims or rescind policies when application answers, for example about multi-factor authentication, turned out to be inaccurate. Accurate answers protect your coverage.
Managed IT
How FinFortify helps with cyber insurance readiness
Risk management and cyber insurance readiness are part of our managed cybersecurity services. We review your controls against the carrier’s questionnaire, close the gaps before renewal, help you answer the technical questions accurately and keep the evidence on file through our managed IT services for financial firms. See also our IT compliance services.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
Cyber insurance questions
What security controls do cyber insurers require?
Most carriers expect multi-factor authentication, endpoint detection and response, separate or immutable backups, email security, patching, security training and an incident response plan. Requirements vary by carrier and policy size.
What happens if we answer an application question incorrectly?
An inaccurate answer can give the carrier grounds to dispute a claim or the policy itself. Have your IT provider check technical answers and keep evidence that each control is in place.
When should we start preparing for renewal?
Start reviewing controls well before the renewal date so there is time to close gaps. Some controls, such as rolling out multi-factor authentication or new backups, take weeks to complete properly.
Get ready for your next cyber insurance renewal
Talk with us about a cyber insurance readiness review.
