The cyber questionnaire: promises you must be able to prove

The decision behind the headline

This review focuses on MFA coverage, patch management, privileged accounts and insurance declarations.

Build an exception register before answering absolute questions. For MFA, list remote gateways, cloud email, administrators, external contractors and service accounts, then identify the authentication actually required for each. For patching, distinguish supported applications from legacy software with no routine update path. Have the technical owner sign off the facts and ask the insurer how exceptions should be disclosed. A planned project is not evidence that a control is already operating.

A hypothetical scenario to test

A company states that MFA is universal, but a remote access tool remains protected only by a password. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

Use the remote-tool example to ask what happens during migration. If an old account remains active while new access is protected, describe the coexistence rather than answering from the new platform alone. Save the completed questionnaire and the insurer’s clarification with the final schedule. If someone later changes a security setting, an internal process should establish whether it also affects a declared condition. Avoid assigning that judgement casually to a non-technical salesperson. The questionnaire should become a reliable dated account of the environment, with ownership for follow-up, rather than a collection of optimistic answers aimed at securing the lowest premium.

Identify the contractual boundary

Translate absolute questions into a system list. “All users” may include contractors, administrators and unattended service accounts, depending on the questionnaire definition. If the answer is uncertain, ask for clarification rather than signing an optimistic yes; record which systems were checked and when.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of questionnaire definitions, declared exceptions, ongoing conditions and change notification. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to check security answers with the technical owner before signing and document exceptions. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare MFA scope reports, patch dashboards, access inventories and signed questionnaires. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.