Free guide · Plain English · No security background needed
Before Your Cyber Insurance Renewal
Five plain-English moves for the week the renewal form arrives — before you answer a single question.
Move 1 — Read the form once, without answering anything
What it is
The renewal packet now includes a supplemental application — a security questionnaire, a few pages long, ending above a line that asks an officer of the company to certify the answers.
Why it's first
Claims kept teaching carriers the same lesson — a handful of basic safeguards separates the small incidents from the catastrophic ones — so the forms stopped taking a yes on faith and began asking for proof. And the forms rhyme: learn the short list once and you have learned it for every carrier you will ever apply to.
Do this
Read it end to end, answering nothing. Note the signature line and which questions read as noise. Expect four themes: two-step login (multi-factor authentication, or MFA), software that watches each computer for break-ins (endpoint detection and response, or EDR), backups you have actually restored from, and a short written plan for a bad day.
Move 2 — Triage it green, amber, red — in one sitting
What it is
Ninety minutes, the form, three highlighters. Green — a confident yes. Amber — probably, but no proof. Red — no, or no idea.
Why it matters
A private snapshot — nobody signs the highlighters — taken while finding out where you stand is still free. The tie-breaker that settles every argument: if you cannot say where the proof would come from, it is not green.
Do this
Answer the form that exists, not the firm you wish you ran. A question that refuses to parse is red with a star — its fix is a definition, not a project. Copy the ambers and reds onto one page, in form order; a red is just an amber with more homework. Prefer a screen? The free Renewal Readiness Check runs the same triage in your browser.
Move 3 — Call your broker with four questions
What it is
A short, booked call where you bring the agenda — not one more email you answer.
Why it matters
Behind the date on the form sits the underwriter's real deadline, often weeks earlier — and the earlier you ask, the more room there tends to be. Practice varies by carrier, so these answers must come from yours.
Do this
Ask, and write the answers down. One: the actual deadline — and who can ask for a short extension if honest work needs more time? Two: who signs the certification? Three: how is an honest no with a dated fix plan treated? (As a normal underwriting document, not a confession.) Four: what proof does the carrier expect — the signed form alone, or evidence attached?
Move 4 — Call your IT provider with three questions
What it is
Three questions that open any control conversation with whoever runs your technology — an in-house tech, a local shop, or a managed service provider (MSP).
Why it matters
Arrive with nothing and the call becomes a tour of the vendor's menu; arrive with the amber list and it prices your work plan. This is direction, not suspicion: they run the tools; the signature stays yours.
Do this
For each amber and red, ask in order: What do we have today? — you want a list, not an adjective. What would closing this cost? — in writing, as a quote. What evidence will you give me? — a dated export, the monitoring arrangement in writing, a note from a tested restore. Then the sentence that makes it durable: would you send me that in an email, so I can file it?
Move 5 — Start the evidence folder tonight
What it is
One folder holding the proof behind your answers: dated exports and screenshots, invoices, the provider's written answers, the restore note.
Why it matters
A yes on the form is half an answer; the artefact behind it is the other half — at claim time, what you certified gets compared with what was true. While every screenshot is one click away, the build takes about an evening.
Do this
Name files date-first — 2026-07-02-mfa-policy.png — so they sort into a history, and never overwrite; a dated series is what "maintained" looks like. Seed it with what already exists: the two-step login settings screenshot, the backup invoice, any written answer a vendor has sent you. File the answers from Moves 3 and 4 as they arrive.
Where to go from here
The free Renewal Readiness Check shows you where your renewal stands in about five minutes — and it runs entirely in your browser, so we never see your answers.
When you're ready to turn that snapshot into a plan with the call scripts, the renewal countdown, and the evidence templates to carry it out, the Full Edition lays it all out — one-time purchase, 30-day money-back guarantee.
This guide provides general guidance and recommended security practices drawn from widely recognised standards. It is not a professional security audit and not legal advice, and it does not guarantee security or prevent any particular breach. Responsibility for your business's security remains with you. Your policy wording controls — confirm specifics with your broker or carrier. © 2026 Sylvan Assurance, LLC.