Your cyber-insurance questionnaire came back short: what to fix

We failed our cyber insurance questionnaire, what now?

Read the questions you answered no to, group them, and treat them as a short project rather than a verdict. A questionnaire coming back short is not a judgement on your business; it is a list of controls a carrier wants to see before it prices the risk, and small offices usually miss the same six or seven. Most are configuration changes in systems you already pay for.

Before touching anything, get the questionnaire itself in front of you. Carriers word things differently, and the difference matters. One asks whether multi-factor authentication is enabled for email; another asks whether it is enforced for all users including administrators and remote access. Those are different questions with different amounts of work behind them.

1. Print or export the questionnaire and mark every answer that was no, unsure or qualified.
2. Split them into identity, backup, endpoint, email, patching, administration and people.
3. For each one, write what is true today rather than what you hoped was true.
4. Ask your IT provider, or an independent one, to confirm each answer by looking at the system rather than from memory.
5. Sort the gaps by how much risk they remove, not by how easy they are.
6. Ask your broker which items are conditions of cover and which merely affect the premium.

That last step saves real money. Some answers move the price; a few decide whether cover is offered at all. Your broker knows which is which for that carrier, and it changes the order you work in. If you would like the technical side checked honestly before you resubmit, send me the questionnaire and I will tell you what is true, what is close and what is a project.

What does cyber insurance require from a small business?

Carriers converge on roughly seven controls, whatever the form looks like: multi-factor authentication, tested backups that an attacker cannot delete, endpoint protection, email filtering, a patching routine, separation of administrator accounts, and staff training. Some add remote access controls, an incident plan, or a rule about verifying payment changes by phone.

Here is the list as it usually appears, with what the question is really getting at.

Notice that none of these is exotic. There is no artificial intelligence, no security operations center, no expensive appliance in the list. Carriers are asking about the controls that stop the attacks they actually pay claims on: stolen credentials, ransomware and invoice fraud. The general small-business picture is in cybersecurity basics for a Dallas small business.

What does multi-factor authentication everywhere actually mean?

It means a second proof of identity on every account that can reach company data, with no exceptions for the owner, the bookkeeper or the shared mailbox. This is the single most common failure, and it is usually not that multi-factor is missing entirely; it is that it covers most people and not all of them. A carrier reads that as no.

In a ten-person office running Microsoft 365 or Google Workspace, this is included in what you already pay and is a configuration exercise rather than a purchase. The work is mostly organisational: deciding what people will use as a second factor, and handling the two or three staff who find it inconvenient.

1. Turn it on for every user account, including anyone part-time and anyone who left a device behind.
2. Turn it on for every administrator account, without exception, since those are the accounts attackers want.
3. Prefer an authenticator app with number matching over text messages, because text codes can be intercepted.
4. Deal with shared mailboxes and generic accounts, which should either have no password sign-in at all or be converted to normal user accounts with their own subscription.
5. Block the older sign-in methods that bypass the prompt entirely, which is the step most offices miss.
6. Cover remote access to the network and to any line-of-business system that faces the internet.
7. Write down the recovery process for someone who loses their phone, before it happens on a Monday morning.

Point five deserves emphasis. There are legacy ways for a mail program to sign in that were designed before multi-factor existed, and while they remain enabled a stolen password still works. Switching them off is a single setting, and it is the difference between an honest yes and an honest no on the form. The Microsoft 365 specifics are covered in Microsoft 365 security for a small business.

What counts as a tested backup that ransomware cannot delete?

A backup counts when a copy exists that the network cannot reach or overwrite, and when somebody has actually restored from it recently. Carriers ask two separate questions here and small offices often answer the first correctly and the second by assumption. If a backup has never been restored, nobody knows whether it works, and the honest answer to the testing question is no.

The threat behind the question is simple. Modern ransomware looks for backups first, and a copy sitting on a drive plugged into the server, or on a shared folder the server can write to, gets encrypted along with everything else. Offline means physically disconnected. Immutable means the storage itself refuses to let anything be changed or deleted for a set period, even by someone holding the password.

1. List what actually needs to survive: the server, the files, the mailboxes, the line-of-business database, and any local data on laptops.
2. Confirm your email and cloud files are being backed up, since a subscription is not a backup and a deleted item purges after a retention window.
3. Get at least one copy offsite, in cloud storage with delete protection or on media that leaves the building.
4. Make the offsite copy immutable if the platform supports it, so a stolen administrator password cannot wipe it.
5. Restore a real file and a real mailbox item this week, and write down the date and who did it.
6. Restore a whole system once, into a test environment, so the recovery time is known rather than guessed.
7. Put a monthly reminder in a calendar somebody actually reads, and record each test.

Point two catches a lot of offices. Microsoft 365 and Google Workspace protect their own infrastructure, not your content from your own mistakes, and a mailbox deleted by an intruder or a folder wiped by a departing employee is your problem. Adding third-party backup for cloud email and files is inexpensive per user and turns two questionnaire answers from no to yes. Backups and recovery planning are described on the cybersecurity, backup and disaster recovery page.

What do they mean by endpoint protection, email filtering and patching?

They mean three things a carrier can verify: security software on every device reporting into one console, filtering that stops phishing before it reaches a mailbox, and a routine that installs updates on a defined schedule rather than when someone gets round to it. The word behind all three is managed. Unmanaged tools are treated as absent, because nobody sees the alert.

The end-of-support row is the one that quietly sinks applications. Almost every small office has one machine kept alive because a piece of software will not run on anything newer, and carriers ask about it directly. If you cannot replace it, isolate it: no internet access, no email, restricted network access, and be ready to describe that arrangement on the form. Carriers will often accept a documented compensating arrangement; they will rarely accept silence.

On patching, a cadence is what is being asked for. Something like security updates inside a couple of weeks of release, tested first on one machine, with a named person confirming they landed. That is exactly the kind of routine work included in managed IT services, and it is the reason a monthly arrangement often answers several questionnaire items at once.

Why do carriers ask about administrator accounts and staff training?

Because the two together decide how far an attack spreads once someone gets in. If the person who clicks a bad link is signed in as an administrator, one mistake becomes a whole-network incident. If nobody has ever been shown what a phishing email looks like, the click is more likely in the first place.

Administrator separation sounds heavyweight and is not. In a ten-person office it means a small number of changes:

1. Every person has a normal account for daily work, with no administrative rights on their computer.
2. Anyone who needs administrative rights has a second, separate account used only for that purpose.
3. The administrator account is never used for email or web browsing.
4. Cloud administrator roles are held by named accounts, not shared logins, and there are at least two of them.
5. A record exists of who holds which elevated rights, reviewed when anybody joins or leaves.
6. Old accounts belonging to former staff or former providers are disabled, not left dormant.

Training does not have to mean a platform and a subscription, although those are cheap and produce the reporting a carrier likes. What matters is that it happens, that it is recorded, and that it covers the three attacks aimed at small businesses: credential phishing, fake invoices and requests to change bank details. Twenty minutes at a staff meeting, written into the minutes, is a real answer. A recurring simulated phishing exercise is a stronger one.

The cultural half matters more than the content. People who fear being blamed hide their mistakes, and a hidden click costs hours. Say plainly that reporting is always the right move and that nobody is in trouble for it. What to do when it happens anyway is set out in someone clicked a phishing email: what to do next.

What order should a small office fix these in?

Fix identity first, backups second, endpoints and email third, and leave the paperwork items for last, because that order removes the most risk per dollar and per hour. Attackers overwhelmingly arrive through a stolen password, and recovery from everything else depends on a backup that works.

A workable sequence for a ten-person Dallas office, assuming Microsoft 365 or Google Workspace:

Steps one and two cost nothing but attention and answer several questions at once. Steps three and four are the cheapest genuine insurance you can buy, entirely apart from the questionnaire. By step nine you are producing the evidence that turns qualified answers into clean ones. Most small offices can complete this list inside a month without disrupting anybody's work.

How do I answer cyber insurance IT questions honestly?

Answer what is true today, verified by looking at the setting rather than remembering it, and describe partial measures as partial rather than rounding them up. An inaccurate answer is worse than a no, because it can give a carrier grounds to dispute a claim at exactly the moment you need it paid.

Practical rules that keep an application both honest and competitive:

1. Verify before ticking. Have somebody open the console and confirm. Memory and reality drift.
2. Read the scope words. All, enforced, and required mean something different from enabled or available.
3. Use the comment box. Most forms allow a note. In progress with a completion date reads far better than a bare no.
4. Describe compensating arrangements. If one unsupported machine must stay, say how it is isolated.
5. Keep the evidence. Screenshots of settings, the restore test log, the training attendance list, dated and filed.
6. Name who answered. Have your IT provider confirm the technical answers in writing to you.
7. Re-answer at renewal. Configurations drift, staff join, and last year's yes can quietly become this year's no.

One more thing, said plainly because it protects you: no IT provider can approve your application, sign off your compliance or promise an outcome. I can tell you what your systems actually do, fix the gaps, and give you evidence for each answer. The carrier and its underwriters decide what they will cover and at what price, and your broker is the person to ask about wording. Anyone in IT who tells you they can get you passed is telling you something they cannot know.

Who can help with this in Dallas?

Any competent provider can do this work, and the useful question is whether they will show you the evidence rather than just telling you it is done. Ask for the console screenshot, the restore log and the list of accounts. A provider who produces those is doing the work; one who cannot may be answering from memory too.

What I do with a questionnaire, so you know what to expect from me or to ask of somebody else:

1. Go through the form question by question and mark what is true today, with the evidence beside it.
2. Produce a short gap list in the fix order above, with effort and rough cost for each item.
3. Do the configuration work, mostly remotely, mostly outside business hours where it touches sign-in.
4. Enroll staff in multi-factor with a short in-person session so the first morning is calm.
5. Run and document a restore test, then set the monthly rhythm.
6. Hand you an evidence pack you can attach to the application and reuse at renewal.

I am Anthony Omini, the owner of Cross River Tech, with over 15 years of IT experience across many industries. I support small businesses onsite across Dallas–Fort Worth and remotely anywhere in Texas. This work can be done hourly at published break/fix rates with no contract, or as part of a month-to-month managed plan priced per user or per device, where the patching, backup testing and account reviews simply happen every month and the evidence accumulates on its own.

Two groups ask about this more than any other. Agencies handling policyholder data have their own regulatory duties on top of their carrier's questions, covered on the IT support for insurance agencies page. Law firms face the same controls framed as client confidentiality, on the IT support for law firms page. If you have a questionnaire in front of you and a renewal date approaching, send it over and I will tell you honestly which answers are already yes.

Questions people ask

Written and reviewed by

Anthony Omini, founder of Cross River Tech

Over 15 years in IT across many industries, now running Cross River Tech, a small owner-led managed IT company in Dallas. Every article is written from his own client work and checked by him before it is published.

Have a questionnaire in front of you? Send me the questions you answered no to and I will tell you which are quick configuration changes and which are real projects.

Ask Anthony(214) 612-7080About Anthony