Cyber renewal: use the annual review to close real control gaps

The decision behind the headline

This review focuses on changes in turnover, systems, sensitive data and security maturity.

Before renewal, compare the current architecture with last year’s signed questionnaire. Identify newly introduced applications, data collections and outside administrators. A booking portal may connect to the calendar, customer records and payment service, so its effect is larger than adding one website feature. Ask the owner of each component to verify permissions and recovery. Document incidents and near misses factually; a suspicious email intercepted by staff is not the same event as a completed fraudulent transfer.

A hypothetical scenario to test

A growing practice adds an online booking portal and cloud records but renews its old questionnaire unchanged. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

Separate completed improvements from planned ones in the submission. If MFA covers office staff but not a legacy remote gateway, state the scope accurately and ask how the insurer treats the remaining exception. Request a comparison between the expiring and proposed policy, including changed sublimits or security conditions. A stable annual premium can conceal narrower benefits, while a higher price may include an extension the business now needs. Rehearse one representative incident after the review so that contact details and authority are current. The renewal file should explain what changed in both the business and contract, rather than recycle an old questionnaire because the invoice arrived on the usual date.

Identify the contractual boundary

A control improvement should have evidence, not merely a project name. Distinguish planned MFA deployment from completed coverage and planned backup tests from successful restoration. Explain transitions honestly to the insurer, especially when old and new systems run together during migration.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of new applications, revised sublimits, changed conditions and retroactive incident handling. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to run a joint renewal meeting with management and the IT provider. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare current architecture, control improvements, incident history and planned migrations. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.