Cyber Insurance Questions Explained for Small Businesses
The questions look simple. The answers need proof.
Cyber insurance forms often ask yes/no questions about MFA, backups, patching, remote access, staff training and phishing controls.
We help UK small businesses understand what those questions really mean, check what is actually in place and avoid guessing before they apply, renew or speak to their broker.
The questions look simple. The answers need proof.
Cyber insurance forms often ask yes/no questions about MFA, backups, patching, remote access, staff training and phishing controls.
The problem is that a short question can hide a technical answer. We help small businesses across Derbyshire & South Yorkshire understand what the questions mean, what to check and where the gaps usually sit.
No jargon - just what the question usually means and what you should check.
If you are not sure whether a control is in place, the safest answer is to check properly.
We help you turn vague answers into proof points you can use with brokers, insurers and clients.
Why cyber insurance forms feel confusing
Insurers often use short questions because the forms need to be simple enough to complete. The controls behind those questions are not always simple.
A yes/no box can hide several systems
MFA might apply to email, but not remote access. Backups might cover servers, but not Microsoft 365. Anti-virus might be installed, but not monitored.
The wording can sound obvious
Questions about patching, firewalls and training can sound basic until you have to prove what is actually happening across devices, people and cloud systems.
The risk is in the detail
Small businesses often answer based on what they think is in place. The safer route is to check the control, record the evidence and fix the gaps.
The big warning: don’t guess
Cyber insurance applications and statements of fact are often based on the information you provide. If answers are inaccurate, incomplete or out of date, it may affect the terms offered, the cover available or how a future claim is handled.
The common cyber insurance questions, explained
These are the areas we most often see small businesses asked about. The wording will vary by insurer, broker, sector and policy, but the control themes are familiar.
Do you use MFA?
Multi-factor authentication is one of the biggest cyber insurance questions because so many attacks start with a stolen password.
What it usually means
MFA should not just mean “we have it somewhere”. You need to know where it is enabled and who it protects.
What to check
Check Microsoft 365, Google Workspace, VPNs, remote access tools, admin accounts, backup portals and any cloud systems holding sensitive data.
Where businesses get caught out
MFA is enabled for normal email users, but not for admin accounts, service accounts, remote access, backups or older cloud systems.
Learn about identity threat detectionDo you have backups?
This sounds simple, but insurers may care about what is backed up, where it is stored and whether you can actually restore from it.
What it usually means
You need more than “we have OneDrive” or “Microsoft keeps our emails”. Cloud storage is not the same as a proper backup.
What to check
Check Microsoft 365 email, SharePoint, OneDrive, servers, databases, laptops, line-of-business systems and any files needed to keep trading.
Where businesses get caught out
Backups exist, but there is no offline or separate copy, no restore test, no clear recovery order and no evidence of when data was last recovered successfully.
Learn about Microsoft 365 cloud backupDo you keep systems patched?
Patching is about closing known security holes before attackers use them. It applies to more than Windows updates.
What it usually means
Insurers may want to know whether you have a process for installing updates across systems and applications, not just whether people click update occasionally.
What to check
Check Windows, macOS, browsers, Adobe, Java, third-party apps, servers, firewalls, VPNs, remote access tools and any internet-facing systems.
Where businesses get caught out
Staff devices update at different times, third-party apps are missed, old VPNs are forgotten, and there is no report showing what is patched and what is still exposed.
Learn about patch managementDo you use anti-virus or EDR?
Traditional anti-virus can still have a place, but many businesses now need managed detection as well as prevention.
What it usually means
The question may be asking whether devices are protected against malware, ransomware and suspicious activity. The detail is whether anyone is watching the alerts.
Anti-virus vs EDR
Anti-virus tries to block known threats. EDR looks for suspicious behaviour on devices and can support faster investigation and response.
Where businesses get caught out
They have basic protection installed, but no managed review, no response process and no clear evidence that alerts are being investigated.
Learn about Huntress Managed EDRDo you train staff on phishing?
Phishing training is not about blaming people. It is about helping your team spot the tricks they are likely to face.
What it usually means
Insurers may ask whether cyber security awareness training is provided regularly, especially around phishing, fraud and suspicious messages.
What to check
Check whether training is regular, whether records are kept, whether new starters are included and whether phishing simulations are used.
Where businesses get caught out
Staff have been warned informally, but there is no training record, no campaign history, no phishing reporting process and no evidence for the insurer or client.
Learn about security awareness trainingDo you control remote access?
Remote access is useful, but poorly controlled remote access is one of the easiest ways to give attackers a route into your business.
What it usually means
Insurers may ask about VPNs, exposed ports, remote desktop, remote support tools and secure gateways.
What to check
Check whether remote access is protected by MFA, whether RDP is exposed, whether old VPN accounts exist and whether firewall rules are still needed.
Where businesses get caught out
An old remote access route is still open, a firewall rule was added years ago, a VPN has weak accounts, or a support tool has been left active without review.
Ask us to review remote accessDo you have social engineering fraud controls?
This is where cyber meets finance. The attacker may not need malware if they can trick someone into changing bank details or approving a payment.
What it usually means
Insurers may ask whether you have checks for payment changes, supplier changes, invoice fraud and manager impersonation.
What to check
Check whether bank detail changes are verified using a trusted route, whether larger payments need approval and whether relevant staff have been trained.
Where businesses get caught out
Payment checks are “common sense” rather than written down, one person can change supplier details, or finance staff are not trained on impersonation and payment diversion fraud.
Talk to us about fraud controlsNot sure what you can safely answer?
That is exactly where our Cyber Insurance Readiness Scorecard helps.
We check the common control areas behind the questions, highlight the gaps and give you a clearer view of what needs fixing before you apply, renew or speak to your broker.
Book a Security Review- MFA and identity security status
- Backup and recovery readiness
- Patch management and device protection
- Anti-virus, EDR and managed detection
- Email security and phishing protection
- Staff training and social engineering controls
- Remote access, VPN, firewall and exposed service risks
- Evidence gaps and recommended next steps
Useful next steps if you find a gap
Once you know what is missing, you can fix the right thing first. No tool dumping. No panic buying. Just practical controls linked to the questions you are being asked.
MFA and identity security
Review Microsoft 365 access, admin accounts, risky logins and identity-based threats.
Huntress ITDREndpoint protection
Add managed detection and response where basic anti-virus is no longer enough.
Huntress Managed EDREmail security
Reduce phishing, impersonation and malicious email risk before it reaches your team.
Avanan Email SecurityCloud backup
Protect Microsoft 365 email, OneDrive, SharePoint and Teams data with a proper backup.
Microsoft 365 Cloud BackupPatch management
Track, manage and report on updates across devices and key applications.
Heimdal Patch ManagementEvidence and assurance
Use Cyber Essentials or SMB1001 to support client, insurer and tender conversations.
Cyber Essentials supportCyber insurance questions FAQs
Straight answers to the questions small businesses often ask once the insurance form lands.
Can you tell us what to answer on our cyber insurance form?
We can help you understand the technical questions and check what is actually in place. We do not provide regulated insurance advice. Your broker or insurer should advise on the insurance side.
What if we have already answered the questions?
If you are worried something may be inaccurate or unclear, speak to your broker. We can help you check the cyber security controls and gather a clearer picture of what is in place.
Is MFA just for email?
No. MFA may also be needed for remote access, admin accounts, backup systems, cloud services, security portals and other sensitive systems.
Does Microsoft 365 count as a backup?
Microsoft 365 has built-in resilience, but that is not the same as a separate backup. If you need to recover deleted, corrupted or encrypted data, a dedicated Microsoft 365 backup is often the safer route.
Is anti-virus enough for cyber insurance?
It depends on the policy, the insurer and your risk profile. Many small businesses now look at managed EDR because it gives better visibility, investigation and response than basic anti-virus alone.
Can you help if our broker has asked for more information?
Yes. Send us the questions and we can help explain the cyber security side, check the controls and recommend sensible next steps.
Can you help after we have been declined?
Yes. We can help identify the likely cyber security gaps, prioritise fixes and prepare better evidence before you go back to your broker or insurer.
Do you sell cyber insurance?
No. We provide cyber security support, readiness checks and evidence-led advice. We do not sell insurance or advise on policy terms.
Send us the questions. We’ll help you make sense of them.
If your cyber insurance form is asking about MFA, backups, patching, phishing, remote access or fraud controls, you do not have to guess. We can help you check what is in place, what is missing and what evidence you may need.
Book your Cyber Insurance Readiness Review
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.