Guides
The cyber insurance application: what underwriters ask and how to answer
What a cyber application and ransomware supplement ask, how insurers rely on your answers, and how to complete them so a claim is not denied or rescinded.
A cyber insurance application is a set of signed statements about your revenue, the data you hold and the security controls you run, and the insurer prices and issues the policy in reliance on them. For most businesses it means a short main form plus a ransomware supplement that asks, control by control, whether you have multi-factor authentication, endpoint detection, tested backups and the rest. Answer as if a forensic investigator will check each line against your network after a loss, because after a ransomware claim one often does.
What you will be asked to complete
Expect some combination of these documents:
- The main application. Legal entity and subsidiaries, industry, annual revenue, employee count, the kinds and volume of personal, health or payment-card records you hold, the limits and retention you want, and your prior coverage. The prior-coverage question matters because the retroactive date is usually set by how long you have carried cyber continuously. See prior acts coverage for how that works in claims-made forms.
- A ransomware supplement or security questionnaire. This is the document that moves price and eligibility. The next section shows what it asks.
- Incident and claim history. Prior cyber incidents, claims, and whether anyone at the company knows of facts that could lead to a claim. Have your loss run or a written "no losses" statement from your prior carrier ready.
- Attestations. Some carriers want a separate signed statement on controls such as MFA.
- An outside-in scan. Many carriers scan your domain and internet-facing systems before quoting, so what you write should match what the scan can see (what drives the cost of cyber insurance covers how scans affect terms).
- Newer add-ons. IOA's 2026 midyear cyber outlook says carriers are adding supplemental diligence on how businesses develop, deploy and govern artificial intelligence, so expect questions about AI tools if you use them in production.
What the questions are really asking
Several carriers post their supplements publicly. The table draws on the Corvus ransomware supplemental application (July 2022 edition, hosted by broker Alliant), the AXIS cyber ransomware supplemental application (January 2022 edition) and The Hartford's CyberChoice ransomware supplement (November 2021). These are older forms and yours will differ, but the pattern is consistent.
| Area | What the form asks | What the underwriter is testing |
|---|---|---|
| MFA | Is it required for email, all remote access, administrator and privileged accounts, vendor access? AXIS also asks which second factor you use (text message, authenticator app, hardware key) | Scope. A rollout that covers email but not administrator accounts is the usual failure |
| Endpoint protection | EDR or only antivirus; vendor; AXIS asks what percentage of endpoints and what percentage of servers it covers | Coverage, and whether anyone watches the alerts around the clock |
| Backups | How often; offline or immutable copies; MFA on the backup console; separate credentials; Corvus offers answers from monthly restore tests down to "untested" | Whether ransomware that reaches your network can also reach your backups |
| Privileged access | Separate admin accounts, a password vault, how many accounts sit in the domain admin group | How far an attacker gets from one stolen password |
| Remote access | Whether remote desktop is exposed, whether the VPN requires MFA | The front doors that ransomware crews use |
| Email security | Filtering, sandboxing, sender authentication, phishing training and simulation frequency | Whether a phishing message gets to a human |
| Patching and old software | Time to patch critical flaws (AXIS offers buckets from under 24 hours to over 7 days); end-of-life systems | Known holes left open |
| Recovery | How many hours to restore critical systems; how long until the business is materially interrupted (AXIS buckets run from under 1 hour to 24 to 48 hours) | Whether your business interruption exposure matches the limit you want |
| Payment controls | Call-back verification and dual approval of wires | Fraud exposure; IOA says social engineering limits are returning to $1 million or more for insureds that show strong payment authentication |
MFA, EDR and backups: the controls cyber insurers now require explains why each control matters and what a credible answer looks like. This guide is about the document and what you are promising when you sign it.
What you are promising when you sign
Read the signature block, because it carries the legal weight. On the published forms:
- A named officer states, after inquiry, that the answers are true, accurate and complete and that no material fact has been misstated or concealed. AXIS lists who may sign: the CEO, president, CIO, CTO, chief security officer, COO, CFO, general counsel or risk manager, or a functional equivalent.
- The statements are described as a material inducement and the policy is issued in reliance on them. AXIS adds that the application, with every supplement, becomes part of the policy.
- You must report material changes between signing and the policy's effective date, and the carrier may withdraw or change its quote. The Hartford's form says the same. If you switch off a control, drop a tool or have an incident after you submit, tell your broker before you bind.
- The Corvus form states that a misrepresentation or non-disclosure of a material matter can make the policy null and void.
- The Hartford's form states that answering renewal questions is not notice of a claim. If you disclose an incident on an application, give a separate notice of claim or notice of circumstances under the policy that is actually in force, because most forms are claims-made.
What can go wrong: the Travelers v. International Control Services filing
The best-known example is Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill.), reported by Carrier Management and analyzed by law firm Barton in a rescission and damages paper. According to Travelers' complaint, the insured's president answered yes to an application question about MFA for administrative or privileged access and signed an MFA attestation. The policy took effect on April 4, 2022. After a ransomware attack on May 25, 2022, Travelers' investigation found, it alleged, that MFA protected only the firewall and not the servers or other systems. Travelers asked the court to rescind the policy and declare that it owed no defense or indemnity.
There was no ruling on the merits. On August 26, 2022, the parties jointly filed a stipulation for rescission and dismissal, and the court entered an order on August 30 declaring the policy void and that no coverage was available under it. The allegations were Travelers' and were never tested in court, so draw the practical lesson and no more: an insurer that finds a material gap between the application and the network after a loss can pursue rescission, and a signed attestation makes that easier to argue.
Whether a carrier can void a policy over a wrong answer, and whether the misstatement must be intentional or merely material, turns on state law and on the policy's wording, including any severability clause that protects innocent insureds. AXIS's own form shows the variation: its Oregon notice says that to deny a claim over a misstatement the insurer must show the information was material, that it relied on it, and that it was material to the risk or fraudulent. Other states differ. For the general rules see insurance applications: why accuracy matters and what misrepresentation costs; for a dispute, consult coverage counsel.
How to complete the application: a process
- Pair the signer with the person who runs the systems. The officer who signs should sit with whoever administers identity, endpoints and backups, whether an IT lead or a managed service provider. Barton's paper points out that the facts may sit with several departments, not only IT.
- Pull evidence for every "yes." An MFA enrollment report from your identity provider, an EDR console export showing how many devices have the agent, the record of your last restore test, a patch report. If you cannot produce it, you cannot say yes.
- Answer for the whole applicant. AXIS states that responses are deemed made for every proposed insured, including subsidiaries, and asks for separate supplements where answers differ. Check acquired companies and remote offices.
- Use the comment box for exceptions. A line such as "MFA on email and VPN; two legacy servers not yet covered, scheduled for November" is honest, and it may cost you a subjectivity instead of a policy.
- Do not round up. "All" means all. "Tested" means someone restored data from the backup and wrote down the result, not that the backup job ran.
- Keep the exact package you submitted, supplements and scan results included, in the same file as the policy. If a claim comes, that is the document the adjuster will hold.
- Re-verify at every renewal. Copying last year's answers is how stale statements end up under a new signature.
A hypothetical: the partial yes
Say a 40-person architecture firm answers yes to "MFA required for all remote access." That is true of the VPN. But the principal's remote desktop connection to the file server was set up years ago through an open port, and the domain administrator accounts use passwords only. Attackers buy a leaked administrator password, log in through that port and encrypt the server and its backup share.
On the claim, the carrier's forensic firm reports how the attackers got in. If the facts do not match the application, the carrier may reserve its rights, apply the ransomware sublimit or coinsurance (ransomware sublimits and coinsurance in cyber policies), or seek to rescind. The better answer, written before binding, would have said: "MFA on email and VPN; remote desktop and administrator accounts not yet covered; closing both within 30 days." That answer might have drawn a higher retention or a condition to fix the two items. It would also have kept the firm from signing a statement the network contradicted. This is an illustration, not a prediction of any carrier's response.
Conditions of binding
A quote can arrive "subject to" items: enabling MFA on a named system, closing an exposed port the scan found, sending a restore-test report. Treat them as obligations. Put the deadline on your calendar, finish the work and send proof to the broker in writing. The pattern is covered under pricing in what drives the cost of cyber insurance, and a written plan for the incident itself is in building an incident response plan your insurer will like. The cyber insurance readiness checklist lists the evidence to gather before you request quotes.
Key takeaways
- The application and supplements are signed representations the insurer relies on, and published forms say a material misstatement can void the policy.
- Underwriters test the scope of each control (all accounts, all endpoints, tested restores), so a partial rollout described as complete is the riskiest answer.
- In Travelers v. International Control Services (C.D. Ill. 2022), the insurer sought rescission over an MFA statement and the case ended with an agreed order voiding the policy.
- Pair the signer with whoever runs your systems, pull evidence for every yes, put exceptions in writing and report changes made before the policy takes effect.
- Rescission rules vary by state, so questions about a specific denial belong with coverage counsel.