FREE TOOL
What does my company need in place for cyber insurance?
Answer 8 questions on the controls brokers and cyber insurers commonly ask about before they cover you: MFA, tested offline backups, endpoint detection, patching, admin account separation, phishing training, an incident plan and network segmentation. See your likely gaps and what each one means at renewal.
0 of 8 answered
Answer the 8 questions left to see your result.
What do insurers commonly check before they cover you?
Cyber insurance applications and the renewal questionnaire after a claim keep returning to the same handful of basics. These controls most often decide whether an attack stays small or spreads, and whether a loss looks preventable afterwards. This tool asks about eight of them, each mapped to the matching control in the CCB’s CyberFundamentals (CyFun) framework [1].
This is not a copy of any single insurer’s application form, and answering "yes" everywhere is not a quote. The exact questions and the weight each one gets vary by policy, so ask your broker what theirs asks.
See the page on backups for what an offline or immutable copy looks like in practice.
What happens if a control is missing when you claim?
A 15-person company is hit by ransomware. It has MFA on email, but the one server holding its accounting backups was reachable from the same network and got encrypted too. At renewal, the insurer asks for proof of offline or immutable backups and a recent test restore. Without it, the next policy either excludes ransomware, costs more, or is not offered at all.
The fix is cheap compared with the alternative: a backup copy the ransomware cannot reach, and a restore test on the calendar. That single control, done and documented, is something an insurer can ask you to prove at renewal.
To check every gap against the full 34 Basic controls, take the CyFun readiness quiz. Curious what downtime would cost if it happens anyway? See the ransomware downtime cost calculator, and whether security is worth the spend: Is cybersecurity worth it (ROI).
Frequently asked questions
- Is this list copied from a specific insurer’s application form?
- No. It reflects the controls that come up repeatedly across cyber insurance applications and broker guidance, not any single policy’s exact wording. This is a self-check, not a quote or advice on a specific policy.
- Does answering "partly" or "don’t know" mean I’ll be refused?
- Not automatically. It flags a point an underwriter is likely to probe, and a documented compensating measure sometimes counts. Treat it as something to fix or clarify before you apply, not a verdict.
- Why does multi-factor authentication (MFA) matter so much?
- Because a leaked or guessed password gives an attacker a working login, and MFA blocks a login that rests on the password alone. Ask your broker whether the form makes it a hard requirement.
- I don’t have cyber insurance yet. Is this still useful?
- Yes. Fixing these gaps before you apply is usually faster and cheaper than fixing them after a refusal. The same controls make up most of what the CyFun readiness quiz checks for a Basic self-assessment.
- Does fixing all of this guarantee a lower premium?
- No. This tool does not price anything. It shows where a broker or insurer is likely to ask follow-up questions, so you arrive with answers instead of surprises.
Related free tools
- CyFun readiness quiz 19 plain questions covering the 34 controls of CyberFundamentals (CyFun) 2025 Basic. A score and a fix-first list, no email needed.
- Ransomware downtime cost calculator Enter your staff count, hourly cost and days down. See what a ransomware attack would cost your company, per day and in total, with the formula shown.
Is cybersecurity worth it (ROI) · What is CyberFundamentals (CyFun)
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/cyber-insurance-readiness/, by Easy Cyber Protection.