A Cyber Insurance Form Is No Place for an Educated Guess

A cyber insurance form can reduce a business’s systems to a neat row of yes/no answers.

MFA? Yes. Backups? Yes. Staff training? Yes.

The boxes are simple. What sits behind them often is not.

Recent proposal forms and statements of fact I have reviewed have asked about multi-factor authentication, backups, patching, remote access, staff awareness and payment fraud controls. The wording varies between insurers, but the difficulty is much the same: the person completing the form may not know exactly what has been configured, tested or recorded.

What does “yes” actually cover?

Take MFA. It may be enabled for Microsoft 365 but missing from an administrator account, a remote access service or another important system. There may be old accounts, exceptions or services that nobody has checked for some time.

A backup question can be equally deceptive. Which data is included? Is the backup separated from the live environment? Who can delete it? When was the last successful restore test?

A green tick in a backup portal shows that a job ran. It does not necessarily show that the business can recover the information it needs.

Staff awareness is another area where different controls can become muddled together. Training records and phishing simulations may help answer questions about staff awareness. Procedures for checking changed bank details, unusual payment requests and supplier instructions are separate fraud controls. A business may have one without the other.

The answer may sit with three different people

The business owner understands how the company operates. The broker understands the policy and what the insurer is asking. The IT provider should know which technical controls are in place.

Problems arise when one person is expected to answer for all three.

This is not usually carelessness. Small businesses are busy, their systems have developed over several years and the form rarely includes a box marked “I need to check with the person who manages this”.

Sometimes, however, that is the only sensible answer.

An inaccurate answer does not have one automatic outcome

For non-consumer insurance contracts, the Insurance Act 2015 sets out a duty to make a fair presentation of the risk.

That does not mean every innocent mistake automatically cancels a policy. The circumstances matter. An insurer would need to show that it would not have offered the insurance, or would have offered it on different terms, had it received an accurate presentation.

The practical lesson is simpler than the legislation: do not guess, and keep a record of what your answer was based on. Questions about policy wording, cover and claims should always go back to the broker or insurer.

Start with the control, not the tick box

We have created a cyber insurance readiness hub for small businesses that need help understanding the technical side of the questions.

• Start with our Cyber Insurance Readiness guide
• See common cyber insurance questions explained
• Understand questions about staff training and phishing
• Check what sits behind backup and recovery questions

The guides explain the controls that may sit behind questions about MFA, backup, patching, training, phishing and remote access. They also help businesses identify what evidence already exists and what still needs checking.

Insurance helps with the consequences. It does not configure the controls.

Cyber insurance can provide valuable support when something has gone wrong. It does not enable MFA, install a missing update, train an employee or test whether a backup can be restored.

Those controls need attention whether or not an insurer has asked about them.

Not sure what your answers are based on?

Share the relevant technical questions with us. We can help you check what is in place, identify missing evidence and explain any gaps that should be discussed with your broker before you complete the form.

Book a Cyber Insurance Readiness Review

Black Swan Cyber Security Solutions provides cyber security support, not regulated insurance advice. Please speak to your broker or insurer about cover, policy terms, disclosures and claims.