The Cyber Insurance Application Is a Free Risk Assessment (If You Take It Seriously)

For a business in Berks or Lancaster County, a cyber insurance application can do more than support a renewal. It can expose whether security controls actually work across the business, or whether answers are based on assumptions.

That distinction matters. Underwriters are increasingly looking for evidence such as system exports, logs, and documented test results, not just “yes” or “no” answers. And if a gap is found, the consequences may extend beyond an uncomfortable renewal conversation: depending on the carrier and risk profile, missing controls can contribute to higher premiums, additional requirements, or difficulty obtaining coverage.

Treat the application as a structured business risk review. Use it to identify what is in place, quantify exposure, mitigate material gaps, and monitor whether your answers stay accurate.

Start with evidence, not a checkbox

Questions like "Do you use multi-factor authentication?" sound simple. In practice, the useful question is: Where is MFA enforced, which accounts are covered, and what evidence confirms it?

MFA might be enabled for employee email but missing from a remote access tool, an administrator account, a backup console, or a third-party connection. In the case described at the end of this article, the business attested that MFA covered its firewall, directory services, backups, and endpoints. The insurer's investigation of a later ransomware event found it in use on the firewall alone. A single "yes" can conceal important exceptions. The same problem applies to endpoint protection, backups, and incident response. A product subscription does not establish that every device is protected. A successful backup job does not prove that critical systems can be restored. A written plan does not show that people know what to do under pressure.

For every answer, ask: What would demonstrate that this is true today?

1. Identify the controls, and the exceptions

Begin by reviewing the application with the people who understand the business’s actual technology environment: leadership, the internal IT team, and any managed service provider. Your insurance broker can clarify the application’s wording, but technical answers should be verified against the systems they describe.

Prioritize four areas that commonly carry significant weight in underwriting:

• MFA and access: Verify enforcement for all users, remote access, and administrative accounts. For administrators, assess phishing-resistant MFA where feasible. Identify legacy authentication protocols and accounts that are exempt, shared, dormant, or managed by vendors.
• Endpoint detection and response (EDR/MDR): Confirm coverage across the full endpoint and server inventory, not just employee laptops. Review deployment and agent-health reports, exclusions, disconnected devices, monitoring arrangements, and telemetry retention.
• Backups and recovery: Document which systems and data are protected, where copies are stored, who can access them, and how they are isolated from production. A 3-2-1-1-0 approach is a useful benchmark: multiple copies, different media, an offsite copy, an offline or immutable copy, and verified recovery without errors.
• Incident response: Maintain a written plan with named roles, escalation contacts, and decision-making steps. A tabletop exercise within the past year can help reveal whether the plan works in practice, and whether the right people know their responsibilities.

Other questions may cover email authentication (SPF, DKIM, and DMARC), vulnerability and patch management, vendor access, security monitoring, and employee training. These areas matter because they influence how an incident starts, how far it spreads, and how quickly the business can respond.

For Berks and Lancaster businesses, the goal is not to assemble paperwork for its own sake. It is to find the places where a control’s stated coverage differs from the way people, devices, and suppliers actually operate.

2. Quantify the risk in business terms

Once gaps are visible, assess their likely business impact. A missing MFA policy is a technical weakness; the business risk depends on what the affected account can reach. An untested backup is a recovery uncertainty; its impact depends on which operations rely on the systems and data it protects.

For each gap, record:

1. The affected people, systems, or data.
2. The likely operational or financial consequence.
3. The current safeguard, if any.
4. The person responsible for addressing it.
5. A target date for review or remediation.

This turns a list of security findings into a decision tool. Leadership can compare the cost and urgency of closing a gap with the potential cost of downtime, recovery, contractual disruption, or loss of customer confidence.

It also helps avoid vague application answers. If EDR is installed on 92% of devices, do not describe that as full coverage. State the scope accurately, identify the remaining devices, and document the plan to address them. A clear exception is more useful than a broad answer that cannot be supported.

3. Mitigate the most important gaps first

Not every finding needs to be fixed at once. Prioritize weaknesses that could enable account takeover, disrupt recovery, or slow incident containment.

That may mean extending MFA to remote access and privileged accounts, removing legacy authentication, bringing overlooked servers into EDR monitoring, or testing a restore of a business-critical system. For backups, preserve the test record: what was restored, when it was tested, whether the data was verified, how long recovery took, and what follow-up work was needed.

For incident response, run a tabletop exercise based on a plausible scenario. Include the people who would make decisions and communicate with employees, customers, vendors, legal counsel, and the insurer. Record what went well, where decisions stalled, and who owns each improvement.

A control only reduces risk when it is properly implemented, maintained, and usable when needed.

4. Monitor whether the answers remain true

An application is a snapshot of the business. Its accuracy can erode when the environment changes: a new remote access method is introduced, a server is added without EDR, an MFA exception expands, or backup failures go unnoticed.

Assign an owner to monitor material controls and keep evidence current. Before signing or renewing, preserve a dated copy of the completed application, supporting exports, relevant logs, the exception list, and the remediation plan. Include who supplied each item and what population it covers.

This documentation supports better decisions and gives the business a clearer record of what was represented at the time. If an application question is unclear, ask the broker or carrier for clarification in writing rather than guessing. Disclose known exceptions and material gaps accurately.

Why accurate answers matter

Consider a case that ran through federal court in Illinois, Travelers Property Casualty Co. of America v. International Control Services, Inc. When applying for a cyber policy, the business answered "yes" to a signed attestation confirming that multi-factor authentication was required for all employees' cloud email, all remote access (including third-party service providers), and every form of administrative access to directory services, backup environments, network infrastructure, and endpoints. The insurer's complaint, filed after a ransomware event, alleged that at the time the application was signed, MFA protected only the firewall and nothing else. The parties ultimately stipulated to rescission, and the court entered an agreed order declaring the policy null and void from inception, with no coverage available under it for past, present, or future claims of any kind. The case was resolved by agreement, so it should not be read as a court's finding that every allegation was proven. It still illustrates the practical consequences that can follow when application answers and actual controls do not align. Read the agreed order and the insurer's complaint. The lesson for business leaders is straightforward: an insurance application is not merely an administrative form. It is a prompt to verify how the business manages access, protects endpoints, recovers data, and responds to incidents. Accurate answers protect decision-making; they do not guarantee that a claim will be covered. Coverage depends on the policy’s terms and circumstances.

Make the application a repeatable risk process

Use the application to identify gaps, quantify their impact, mitigate priority issues, and monitor changes over time. That process is valuable even if no renewal is due today.

B&R Computers’ Cyber Insurance Readiness Checklist can help your team organize questions and evidence. For broader guidance, visit the B&R resources hub or join the General Cyber Briefing.

If your business wants a clearer view of its most important technology risks and what to address first, schedule a Business Review. A focused review can help your leadership team turn application questions into a practical, prioritized risk plan.