Why the questionnaire got harder
Cyber insurers used to underwrite on revenue and industry. They now underwrite on controls, because they have enough claims history to know which controls actually reduce payouts. That’s why the questions got specific and why the answers now move your premium.
It also means something more uncomfortable. The questionnaire is part of your policy. If you answer yes to a control you don’t have, and a claim later turns on that control, the insurer has grounds to reduce or deny it. An optimistic questionnaire is worse than an honest one with gaps, because the honest one still pays out.
What they’re actually asking about
The wording varies by carrier. The subjects don’t. Almost every questionnaire covers these.
Multi-factor authentication. Not “do you have MFA” but where. Email, remote access, administrator accounts, and any cloud system holding sensitive data. Partial coverage is the most common honest answer and it is a legitimate one, as long as you say so.
Backup and recovery. Whether backups exist, whether they’re separated from your main environment, and whether you’ve ever restored from one. That last question is the one businesses fail. A backup nobody has restored from is a hope, not a control.
Endpoint protection. What runs on laptops, desktops, and servers, and whether anything is watching it. “We have antivirus” is a weaker answer in 2026 than it was five years ago.
Patching and end-of-life systems. How quickly updates get applied, and whether anything in the business is past its support date. An unsupported server is one of the fastest ways to a declined quote.
Access control and offboarding. Who has administrator rights, and what happens to an account when somebody leaves. Dormant accounts belonging to former staff are the single most common finding when we assess a business.
Email security and staff training. Filtering, and whether people get trained on what a convincing message looks like now.
Incident response. Whether there’s a written plan, who gets called, and in what order.
Vendors. Who else touches your systems and what access they hold.
How to answer
Get the technical questions to whoever runs your IT before you fill anything in. Several of these have answers that feel obvious and aren’t. “Do you have MFA” is usually answered yes by an owner and “on some things” by the person who configured it.
Answer what’s true today, not what’s planned. A control that goes live next month is not a yes. Most carriers will take “no, scheduled for November” perfectly well. What they won’t take is finding out at claim time.
Where the answer is no, find out what changing it costs. A surprising number of these are configuration rather than purchase. Turning MFA on for the last group of users, removing dormant accounts, and running a restore test are all typically an afternoon of work and no new spend. Knowing which “no” answers are cheap is most of the value in this exercise.
Attach a remediation plan with dates. This is the step most businesses skip and the one underwriters respond to. A set of “no” answers with a credible timeline reads very differently from a set of “no” answers alone. It often affects the terms you’re offered.
What to do with the leftovers
After the cheap fixes, you’ll usually have two or three items that need budget, a maintenance window, or both. Put them in your technology plan rather than treating them as an insurance problem. They were real risks before the questionnaire arrived and they stay real after it’s filed.
Keep the completed questionnaire. Next year’s version will ask most of the same things, and having last year’s answers alongside what changed turns a three-week scramble into an afternoon.
Where we come in
Every FlexPath company works from the same security baseline, and that baseline is built around roughly the same controls these questionnaires ask about. That’s not a coincidence. It means that for the businesses we support, most of the questionnaire has an answer already, and the evidence behind it exists because normal operation produces it.
If a questionnaire is sitting on your desk now, send it over. We’ll work through it with you, tell you honestly where you stand, and turn whatever’s left into a plan with dates on it.
This is general information about a common business process, not legal or insurance advice. Your policy terms and your carrier’s requirements govern.
