A Practical Checklist for Getting Ready for a Cyber Insurance Application

Applying for cyber coverage can feel harder than buying it. Many small businesses already use some security tools, but they are not sure whether those tools match common insurer expectations or how to prove that they are in place.

That gap matters. Insurer questionnaires often ask for clear answers about multi-factor authentication, endpoint protection, backups, employee training, and incident response planning. If your answers are incomplete, inconsistent, or overly optimistic, the process can slow down quickly.

This guide is a practical small business cyber insurance checklist you can work through step by step. The goal is not to promise approval. It is to help you verify what you have, identify what is missing, and organize documentation so your application or renewal is easier to complete accurately.

Documenting Essential Security Controls for Insurer Questionnaires

A common problem is not the lack of security controls, but the lack of documentation. Insurers often want evidence that a control is actually turned on, applied broadly, and reviewed regularly.

Start by listing the controls you already use. Focus first on the items that commonly appear in questionnaires, such as MFA, endpoint protection, email security settings, backups, patching, and access controls. If you use Microsoft 365 or Google Workspace, note which protections are enabled for admin accounts, employee logins, and email handling.

For each control, keep simple proof in one central folder. That proof can include screenshots, policy documents, training records, setup summaries, and logs. The goal is not to create perfect enterprise documentation. The goal is to make it easy to answer questions truthfully and consistently.

A simple documentation checklist can help.

• MFA enabled for admin accounts
• MFA enabled for employee accounts, if applicable
• Endpoint protection deployed to company devices
• Email authentication records documented, including SPF, DKIM, and DMARC if used
• Written password policy or employee cybersecurity policy
• Backup schedule and storage method documented
• Vendor access list and remote access rules documented
• Employee security training dates recorded
• Incident response plan stored in an accessible location

It also helps to track each control in a small working table.

Control	In place?	How verified	Evidence stored
MFA	Yes/No	Admin console review	Screenshot or export
Endpoint protection	Yes/No	Device console check	Coverage report
Backups	Yes/No	Backup dashboard review	Job logs and restore notes
Email authentication	Yes/No	DNS and mail settings review	Screenshot or change record
Training	Yes/No	Attendance or completion log	Training record

This kind of record makes insurer questionnaire preparation much easier because you are not rebuilding answers from memory each time.

Verifying Endpoint Protection and Device Visibility

Endpoint protection verification is one of the most important parts of cyber insurance readiness. It is not enough to assume devices are covered. You need to confirm which devices exist, which ones are protected, and whether basic security settings are applied consistently.

Begin with a device inventory. Include laptops, desktops, company phones if managed, and any servers or shared systems your business relies on. If a device accesses business email, customer data, accounting systems, or cloud storage, it belongs on the list.

Then verify coverage. Many insurers now ask about endpoint detection and response or similar endpoint monitoring controls. Even when wording varies, the practical question is usually the same: can you see your devices, protect them, and respond if something suspicious happens?

Review these items.

• Current device inventory exists and is up to date
• Each company-managed device has endpoint protection installed
• Operating system updates and security patches are applied on a defined schedule
• Remote access tools are approved and documented
• Former employee devices and accounts are removed from access lists
• Administrative accounts require MFA
• Shared admin credentials are avoided or tightly controlled

If you find gaps, note them clearly instead of guessing. A partial but accurate answer is safer than claiming a control is fully deployed when it is not.

For small teams, this can be as simple as keeping one spreadsheet with these columns.

Device	Owner	Endpoint protection present	Last patch check	MFA required for admin access
Laptop A	Employee name	Yes/No	Date	Yes/No
Laptop B	Employee name	Yes/No	Date	Yes/No

This gives you a direct way to support answers about device visibility, patching, and endpoint protection verification without relying on memory or informal notes.

Backup Requirements: Immutability, Testing, and Restore Verification

Backups are often misunderstood in cyber insurance applications. Saying that backups run every day may not be enough. Underwriters commonly look for evidence that backups are protected from tampering and that restores have actually been tested.

That is why backup requirements for cyber insurance often focus on three questions:

1. Are backups separated well enough to resist ransomware or account compromise?
2. Are backups running on a defined schedule?
3. Can you prove that important data can be restored?

If possible, document whether your backups are offline, immutable, or otherwise segregated from your main environment. Use plain language. You do not need to overstate the design. Just describe what is true.

Keep a backup testing log with the basics.

• What data or system was backed up
• Where the backup is stored
• How often backups run
• Date of last successful backup review
• Date of last restore test
• Result of restore test
• Any issues found and whether they were fixed

A simple log may look like this.

System or data	Backup frequency	Storage type	Last successful job	Last restore test	Result
File storage	Daily	Cloud with protected retention	Date	Date	Successful/Issue found
Accounting data	Daily	Segregated backup location	Date	Date	Successful/Issue found
Email data	Defined schedule	Provider or third-party backup	Date	Date	Successful/Issue found

This is especially useful for a cyber insurance application checklist because it turns a vague answer like "we have backups" into a documented answer with dates and evidence.

If you are not yet doing restore tests, make that a priority. Running backup jobs is helpful, but restore verification is what shows the backup is likely to be usable when needed.

Incident Response Planning and Employee Training

Insurers often want to know what your business will do if something goes wrong. A written incident response plan does not need to be long, but it should exist, be current, and be easy to find.

Your plan should answer a few practical questions.

• Who makes decisions during a cyber incident?
• Who should employees notify first?
• How will you contain the issue, such as isolating a device or changing passwords?
• Who handles outside communication with customers, vendors, legal counsel, or your insurer?
• Where are backup and recovery instructions stored?

For a small business, a one- to two-page plan may be enough if it is specific and usable. Include names or roles, current contact details, and the date of the last review.

Employee training matters for the same reason. Many incidents begin with everyday mistakes, especially around email, passwords, invoice changes, and suspicious links or attachments. Annual training is a practical baseline, and additional reminders during the year can help reinforce it.

Keep records for insurer review.

• Training date
• Topic covered
• Who attended or completed it
• Copy of any handout or policy used
• Date the incident response plan was last reviewed
• Current version number or file date

This documentation helps show that security awareness is not just informal advice. It is part of a repeatable process supported by written materials and regular review.

Preparing for Insurer Questionnaires and Audits

Once your controls and evidence are organized, the next step is to prepare for the actual questionnaire. This is where many businesses lose time by searching across inboxes, admin portals, and old notes.

Create one master checklist based on the questions you expect to see. Group it by topic so you can review it quickly before an application or renewal.

A useful sequence is:

1. Collect the insurer form or broker questionnaire.
2. Highlight questions about MFA, endpoint protection, backups, email security, access control, and incident response.
3. Match each question to existing evidence.
4. Mark gaps as "not yet complete" rather than answering too confidently.
5. Assign owners and deadlines for missing items.
6. Review all answers for consistency before submission.

You can also use a simple readiness tracker.

Questionnaire topic	Status	Evidence ready?	Notes
MFA	Complete/Partial/Missing	Yes/No	Scope and exceptions
Endpoint protection	Complete/Partial/Missing	Yes/No	Coverage gaps if any
Backups	Complete/Partial/Missing	Yes/No	Last restore test date
Incident response plan	Complete/Partial/Missing	Yes/No	Last review date
Employee training	Complete/Partial/Missing	Yes/No	Last training date

Be careful with wording. If a control is only deployed to some users or devices, say that clearly. If a project is in progress, note that it is in progress. Accuracy matters more than sounding fully mature.

Finally, review your documentation on a regular schedule, not only when renewal season arrives. That makes future applications easier and reduces the chance that your written answers drift away from your actual environment.

Conclusion

Cyber insurance readiness is mostly about discipline, not perfection. Small businesses can make real progress by verifying what is in place, documenting it clearly, and updating that record before an application or renewal is due.

If you use this checklist approach, focus on the controls insurers commonly ask about: MFA, endpoint protection, backups, incident response, and employee training. Then make sure you can support each answer with simple evidence.

That will not guarantee approval or claim payment, and it does not replace advice from your broker, insurer, lawyer, or IT professional. But it can help you avoid incomplete applications, reduce confusion during renewals, and build a more reliable security baseline for day-to-day operations.