Your first cyber insurance renewal questionnaire

The renewal packet arrives from your broker six weeks before the policy lapses. Last year it was two pages of company details. This year it is a questionnaire: dozens of yes/no questions about two-step login, backups, endpoint software, and who can still sign in after they leave. For a small business owner the temptation is obvious — tick yes down the column, sign, send it back. That instinct is the expensive one. The renewal form is not admin. It is underwriting, and the way you answer it shapes your premium, your cover, and whether a future claim is paid without a fight.

The form is underwriting, not admin

Cyber insurers spent years paying ransomware claims on policies priced with almost no questions asked. The market's answer was to underwrite the way property insurers always have: on the state of the thing insured. The questionnaire is the survey. Each question maps to a control the insurer has claims data on, and your answers feed directly into the premium you are quoted, the conditions attached, and in some cases whether you are offered renewal at all.

The part small businesses miss: the completed application typically forms part of the policy itself. An answer that was optimistic rather than accurate does not disappear when the policy is bound — it can resurface at claim time, when the insurer's investigators compare what you said with what was actually running. A misstatement on a material question can give the insurer grounds to reduce a payout, dispute the claim, or in serious cases treat the policy as void. Nobody involved in a ransomware recovery wants to be simultaneously arguing about whether the two-step login box was ticked honestly.

Read it as a list of controls, not questions

Strip away the phrasing and most renewal forms ask about the same short list of controls, because those are the ones the claims data keeps pointing at:

• Two-step login (Multi-Factor Authentication, MFA) — especially on email, remote access, and administrator accounts. This is the question insurers press hardest on, and "on some accounts" is not "yes".
• Backups that would survive an attacker — kept offline or otherwise separated from the network they protect, and actually tested by restoring from them, not just configured.
• Endpoint detection and response (EDR) — modern monitoring software on company computers, not just traditional antivirus.
• Patching — how quickly known software weaknesses get fixed, particularly on anything reachable from the internet.
• Email and payment controls — protections against spoofed email, and a verification step before anyone changes bank details on an invoice.
• Leavers — whether access is removed promptly when someone leaves.
• An incident response plan — written down, with the first phone calls known before the bad day.

Reading the form this way changes the job. You are not filling in a questionnaire; you are checking seven or so controls against reality. Some you have. Some you half-have. Some you do not have — and now you know which ones the people who price your risk consider most important, which is useful information you did not pay for.

Answer honestly — an optimistic yes is the expensive kind

Underwriters read hundreds of these forms. A column of unqualified yeses from a ten-person company reads as either exceptional discipline or wishful ticking, and they price for the second. Honest, specific answers are more credible and they protect the claim you hope never to make. Three patterns cover almost every gap:

• Partly, with a date. "Two-step login is enforced on email and remote access today; rollout to remaining administrator accounts completes by [date]."
• Covered another way. "We do not run a dedicated EDR product; company devices are managed and monitored through [named tool], and we are evaluating EDR for [quarter]."
• Not applicable, with a reason. "We hold no card payment data; payments are processed entirely by [provider]."

A no with a date is a negotiating position — some insurers will quote with a condition that the control lands by an agreed date, and closing a gap before you sign can be worth more than any amount of careful wording. A false yes is a claim dispute waiting for its moment. If the form asks about a control you genuinely do not understand, ask your broker what the question means before answering; that is part of what they are for.

Keep the evidence you would need on the worst day

Every answer you give implies evidence you could show: the settings page that proves two-step login is enforced, the log from the last successful restore test, the export showing which devices run the endpoint software, the dated offboarding checklist from the last leaver. Collect it once, as you answer — a screenshot, an export, or a policy reference per control, each dated and filed in one place.

This pack pays for itself twice. At renewal, next year's form becomes an hour of checking what changed rather than an archaeology project. And at claim time — when the insurer asks you to demonstrate the controls you declared, in the same week you are rebuilding systems — the answer is a folder you already have, not a scramble through settings pages under the worst possible conditions.

Start the clock sixty days out

The renewal form rewards preparation more than speed. Sixty days before renewal, pull last year's application and re-read what you declared — that is the baseline the insurer remembers. Check each answer against reality and note what changed: new tools, new people, controls that quietly lapsed. Thirty days out, talk to your broker with questions of your own: what has changed on this year's form, which answers drove the premium last time, and what the market is asking for now. And before you sign, read the policy schedule as carefully as the questionnaire — headline cover limits often carry lower sub-limits for the events most likely to happen to a small business, such as ransomware or funds transferred to a fraudster, and it is better to discover that at renewal than at claim time.

None of this requires a security team. It requires treating one form, once a year, as what it actually is: the cheapest security audit you will ever receive, conducted by people with excellent data on how small businesses actually get hurt.

When you want this ready to use

Sylvan Assurance's Cyber Insurance Readiness toolkit turns this into a guided renewal: a renewal form decoder that explains what each question is really asking and what counts as a defensible yes, a plain-English guide to standing up the controls insurers ask about, and an evidence pack checklist with a renewal countdown to run the sixty-day clock. Higher editions add per-control proof templates, a broker call script, and a claim-readiness tabletop exercise for the team — with a Pro Advisor edition for the consultants and Managed Service Providers (MSPs) who run renewals for clients. Editions from $49; the toolkit page has the full breakdown.

The free Renewal Readiness Check at sylvanassurance.com/free/cyber-insurance walks the questions carriers actually ask and returns a tailored guide. It runs entirely in your browser; your answers are never sent anywhere.

Prefer the long form? The companion Sylvan Press title, Cyber Insurance in Plain English, covers the same ground in depth.