Cyber Insurance Underwriting Questionnaire: Why Insurers Keep Asking the Same Things

What Is Actually Being Tested in a Cyber Insurance Application?

Anyone who has filled out more than one cyber insurance underwriting questionnaire notices the pattern fast: different carrier, different logo, nearly identical questions. That repetition is not laziness on the insurer's side. It reflects a narrow set of controls that loss data has repeatedly shown to separate businesses that recover quickly from a cyber event from those that end up filing a six-figure claim. Understanding why those ten or so questions keep resurfacing helps a business prepare answers that hold up, rather than scrambling each renewal season to remember what was submitted last time.

Why do cyber insurers keep asking about multi-factor authentication?

MFA adoption is the single strongest predictor insurers have found for ransomware susceptibility, so it appears near the top of almost every form.

Ransomware groups overwhelmingly get in through stolen or guessed credentials on remote access tools, email, and cloud admin panels. Once MFA is in place on those entry points, the same credential theft stops working, which is why insurers ask not just "do you have MFA" but where, specifically, it is deployed. A yes answer that only covers the office VPN and skips cloud email or privileged accounts is treated very differently from full coverage across all three.

What do underwriters want to know about backups and recovery?

They want proof that backups would actually survive the same attack that took down production systems, not just confirmation that backups exist.

A questionnaire section on backups usually asks three things: whether backups are offline or immutable, how often recovery is tested, and how long a full restore would take. Insurers have seen too many claims where backups existed on paper but were encrypted along with everything else because they sat on the same network. The Cyber Insurance Risk Assessment Tools underwriters increasingly use score this gap automatically, flagging backup answers that sound complete but leave systems connected to the same domain.

How much does the questionnaire probe incident response readiness?

Enough to distinguish a business with a tested plan from one that has a document nobody has opened since it was written.

Does a written incident response plan matter more than having one at all?

A plan that has never been rehearsed is only marginally better than no plan, in an underwriter's eyes.

Underwriters have learned that written plans without tabletop exercises tend to fall apart in the first hour of a real incident, when decision-makers are unreachable or the escalation contacts are outdated. Questions about the last time the plan was tested carry real weight in scoring, not just whether a document exists in a shared drive somewhere.

Why do insurers ask who tests the plan?

Because internal-only testing misses gaps that only surface when an outside party, like a breach coach or forensics firm, walks through the process.

Carriers increasingly ask whether incident response testing has ever involved external partners. A plan tested only by the same internal team that wrote it tends to have blind spots around legal notification timelines and vendor coordination that only become visible under outside scrutiny.

Why is employee security training always on the list?

Because phishing remains the most common way attackers get initial access, and training frequency correlates with how often employees fall for it.

Questionnaires typically ask how often training happens, whether it includes simulated phishing, and what percentage of staff completed the most recent session. A once-a-year training checkbox scores lower than ongoing, measured programs, since insurers have data showing click rates drop meaningfully with repeated simulation.

What role does vendor and third-party risk play in the questionnaire?

A growing one, since many recent large losses originated through a vendor's systems rather than the policyholder's own network.

Modern questionnaires ask how many critical vendors have access to internal systems, whether those vendors are contractually required to carry their own cyber coverage, and how vendor access is monitored. This section has expanded significantly in the last few underwriting cycles as supply-chain breaches have grown more common.

Questionnaire Section	What It Looks Like on the Form	What Underwriters Are Actually Scoring
Access control	"Is MFA enabled?"	Coverage breadth across remote access, email, and admin accounts
Backup resilience	"Are backups performed regularly?"	Whether backups are isolated from production and restore-tested
Incident response	"Do you have an IR plan?"	Whether the plan has been rehearsed, and with whom
Security awareness	"Do employees receive training?"	Frequency, simulation use, and completion rates
Vendor risk	"Do you assess third-party vendors?"	Contractual requirements and monitoring of vendor access

How does a completed questionnaire turn into a bindable submission?

Once the core answers are consistent and documented, the questionnaire becomes the backbone of the broader Cyber Insurance Broker Submission Package that gets sent to multiple markets.

Underwriters rarely bind coverage off the questionnaire alone. It sets the baseline risk picture, then gets checked against the rest of the submission, including any external scan data, before running through a Cyber Insurance Underwriting Checklist that decides whether the file gets approved, sent back for more information, or declined. Tools like Insurnest's Security Posture Assessment AI Agent exist specifically to catch inconsistent answers before they reach an underwriter's desk.

The same ten questions keep showing up because they keep working. A business that treats the questionnaire as a formality to rush through tends to get surprised at renewal, or worse, at claim time, when the gap between what was submitted and what was actually in place becomes obvious. Treating it instead as an honest inventory of security controls tends to produce faster quotes, fewer follow-up requests, and coverage that actually responds when it is needed.

Sources

• NIST Cybersecurity Framework, National Institute of Standards and Technology
• Cross-Sector Cybersecurity Performance Goals, Cybersecurity and Infrastructure Security Agency
• Turn On MFA, Cybersecurity and Infrastructure Security Agency