Your Cyber Insurance Renewal Is Really an IT Audit: Here's How to Pass It

December 1st, 2026

A laptop and phone on a desk beneath the words Cyber Insurance.

Most business owners treat cyber insurance renewal as paperwork: answer the questionnaire, accept the premium, file the certificate with the other policies. That was a reasonable approach when the application asked whether the company had a firewall and an antivirus program. It is a poor approach now.

The modern application is a control audit with a price attached. Insurers are asking how identity is protected, how backups are isolated, how quickly systems are patched, and whether anyone has ever tested the recovery plan. The answers determine the premium, the deductible, the sub-limits, and whether a claim gets paid at all. A wrong answer is not a harmless sales estimate. On many policies the security representations become warranties, which means a claim can be denied if the described controls were not in place on the day of the incident.

The good news is that the questions are predictable. An IT provider or an internal team that knows what to collect can walk into renewal season with a dossier instead of a scramble.

Why the Renewal Questionnaire Got Harder

Cyber insurance used to be priced loosely because losses were sporadic and the market was competitive. Ransomware changed the math. Carriers paid large claims for years, then tightened underwriting across the board: higher retentions, lower limits for ransomware and extortion, and far more detailed control questions. Many now require a separate security supplement, a call with an underwriter, or a scan of the company's external attack surface before they will quote.

Underwriters are not evaluating good intentions. They are evaluating whether a business is likely to be hit, how much a hit would cost, and whether the business can recover without paying a ransom. A company that cannot restore its own systems is a worse risk than one that can, regardless of how many security products it owns.

The Questions Behind the Questions

The wording varies by carrier, but most supplements circle the same control areas. What matters is not whether a capability exists somewhere in the building, but whether it is enforced and can be demonstrated.

Multifactor authentication. Not "do you offer MFA," but "is it required for email, remote access, privileged accounts, and all users." The follow-up is usually about legacy exceptions, service accounts, and whether text-message codes are the only method. Carriers increasingly prefer authenticator apps, push approval, or hardware tokens for administrator accounts.
Endpoint protection. Antivirus alone is no longer enough. Applications ask about endpoint detection and response, whether the agent is healthy on every server and laptop, and who reviews the alerts. An EDR tool with nobody watching it is a weaker answer than the questionnaire implies.
Backups. The key questions are whether backups are immutable or offline, whether they use separate credentials, how often restores are tested, and how long recovery takes. A nightly backup that an attacker with domain administrator rights can delete does not satisfy the intent of the question.
Patching and vulnerability management. Carriers ask about cadence, critical vulnerability remediation times, and whether internet-facing systems receive priority. They also ask whether unsupported software, such as an end-of-life server or an old phone system, remains in production.
Privileged access. Are administrator accounts separate from daily-use accounts? Is local administrator access restricted? Are shared credentials, a common shortcut at small companies, still in use?
Network controls. Firewalls, segmentation, remote access method, and whether remote desktop is exposed to the internet. Exposed RDP is one of the fastest ways to get a worse quote or a declined application.
Incident response. Is there a written plan, a named response team, a contact tree, a forensics vendor, and a date for the last tabletop exercise? A plan created for the application and never rehearsed is a common weakness.
Training and phishing. Completion rates, simulation frequency, and whether results are tracked. Underwriters know that a workforce trained once at onboarding is not the same as one tested quarterly.
Asset inventory and vendor risk. A company that cannot list its servers, cloud services, and third-party vendors cannot credibly answer the rest of the application.

What Counts as Evidence

An assertion is not evidence. When a broker asks for support, or when a claim is reviewed after an incident, the useful documents are the ones generated by the systems themselves.

Identity report. An export from the identity provider showing MFA enforcement by user and group, with the exceptions listed separately and justified. Include administrator accounts and service accounts.
Endpoint coverage report. The count of servers and endpoints with a healthy agent, compared against the asset inventory. A missing server is a finding, and hiding it is worse.
Backup report. The last successful backup for each critical system, the last restore test with its date and result, retention settings, and who can delete backup data.
Patch report. Open critical and high vulnerabilities, how long they have been open, and the remediation schedule. "We patch monthly" without a report is not evidence.
Privileged access listing. Domain administrators, global administrators, and other high-privilege groups, with a note on which accounts are separate from daily-use accounts.
Incident response plan. The plan itself, the contact list, the insurer's notification number, and the date of the last tabletop exercise. The same page should state who can authorize an emergency spend.
Training record. Completion percentage and recent phishing simulation results, including repeat clickers.
Network diagram. A current diagram showing the firewall, the segments, remote access, and where the critical data lives. It does not need to be beautiful, but it needs to be accurate.

Keep the evidence pack in one folder and update it before each renewal. The work pays for itself in two places: better terms at renewal, and a shorter, cheaper response if an incident actually happens.

Where Applications Fall Apart

MFA with exceptions. Email is protected, but the VPN, a legacy application, or the domain administrator account is not. Underwriters ask about the exception because that is where incidents start.
Backups inside the blast radius. Backups stored in the same cloud tenant, with the same administrator credentials, are convenient and easy to destroy. A separate account, immutable storage, or an offline copy is the answer that carries weight.
No restore test. The backup job says success, but nobody has proven a system can be recovered. Test one critical system, record the time and result, and repeat on a schedule.
Endpoint gaps on servers. Laptops get the new agent; the servers running the line-of-business application do not. Those servers hold the data attackers want.
Shared administrator accounts. When several people use one administrator login, no one can prove who did what. It also makes offboarding harder, because the password has to be changed every time someone leaves.
Questionnaires completed by someone without IT input. The office manager answers from memory, marks the strongest option, and creates a warranty the company cannot meet. This is how a claim problem begins before any incident.
Assuming the broker will fix it. A broker can market the policy and argue the terms, but only the company can produce the control evidence.

The most expensive mistake is answering yes to a question the company cannot support. If a control is missing, say so and describe the compensating control and the plan. Material misrepresentation can void coverage when it is needed most.

The 90-Day Renewal Calendar

Ninety days out: request the renewal application and the current policy from the broker. Assign an owner to every question, not just to the document. Run an internal evidence audit and list every gap, including the controls that exist but cannot be proven.
Sixty days out: close the gaps with the highest claim impact: MFA on email, remote access, and administrator accounts; EDR coverage on servers; immutable or offline backups; critical patches on internet-facing systems; removal of exposed remote desktop.
Thirty days out: test one restore, run a tabletop exercise, and assemble the evidence pack. Meet the broker with the pack and the remaining gaps in hand, so the negotiation starts from facts rather than a blank questionnaire.
At renewal: read the policy wording, not only the premium. Confirm that the controls described in the application match what the company actually does, and that any warranty language is understood before signature.

If You Cannot Close a Gap in Time

Not every gap can be fixed in a quarter. A legacy application that requires an unsupported server, a phone system that cannot enforce modern authentication, or a budget cycle that has already closed can leave a real exception. In that case, present it honestly with a remediation plan: what is missing, what reduces the risk in the meantime, who owns the fix, and the date it will be complete. Underwriters sometimes accept compensating controls, and a broker can place the policy with a carrier whose appetite fits the risk.

A higher premium is survivable. A denied claim after a ransomware event is not. The application is not the place to save money by overstating controls.

Read the Policy, Not Just the Price

Coverage terms matter as much as the limit shown on the declarations page. Ask the broker to explain, in plain language:

Ransomware and extortion sub-limits. A policy with a $2 million overall limit may cap ransomware payments far lower.
Coinsurance. Some policies require the insured to pay a percentage of every covered loss, which changes the real cost of an incident.
Waiting periods and restoration periods. How long before coverage begins, and how long business interruption benefits last.
Claims-made terms and the retroactive date. Which incidents are covered, and which predate the policy.
Social engineering and wire fraud. These are often excluded or sub-limited, even though they are a common small-business loss.
The incident response panel. Many policies require the use of approved forensics and legal vendors. Using someone else can reduce or void reimbursement.
Notification deadlines. Many policies require notice within a set window, often 24 to 72 hours. The response plan should name the person responsible for making that call.

Bottom Line

The renewal questionnaire is a fair summary of what a company should already be doing. Multifactor authentication, endpoint detection and response, tested backups, patching, restricted administrator access, and a rehearsed incident response plan are the same controls that make an incident survivable. Passing the audit is a byproduct of doing the work, and the evidence pack is the proof.

TOTLCOM helps businesses across Northern California prepare for network security reviews, close control gaps, and produce the documentation insurers ask for. If renewal is approaching, start with our network security articles, including the ransomware survival guide and an estimate of what a ransomware attack costs, or contact us to review your controls before the questionnaire arrives.

Posted in: Network Security