Cyber Insurance Questionnaires: The Network Questions, Answered

The new page on the renewal form

A few years ago a cyber insurance renewal was a turnover figure and a signature. Now it is three pages of questions about multi-factor authentication, backups, patching, firewalls, remote access and Wi-Fi, and an increasing number of larger clients send a near-identical questionnaire before they will sign a contract with you.

We help a lot of North West firms answer these, from solicitors in Chester to hospitality groups in Manchester, and the pattern is always the same: the owner opens the form, understands about half of it, and is tempted to tick yes to the rest. This article is the half they do not understand, question by question, with what the insurer is really checking, what a good answer looks like, and what to do first if the honest answer is no.

One rule before we start. Answer honestly. A no with a dated plan to fix it is acceptable to almost every insurer. A yes that turns out to be untrue when a claim is investigated can void the policy, which is a far worse outcome than a slightly higher premium.

The questions, what they mean, and the honest answer

The questions that trip people up

Three of these catch out otherwise well-run firms, and they are worth a closer look.

"Kept offline or immutable." Many businesses have backups. Far fewer have backups that ransomware cannot reach. If your backup is a drive plugged into the server, or a cloud folder the server can write to, an attacker who encrypts the server encrypts the backup as well. The insurer's question is really "when you get hit, will you have anything left?" The answer needs at least one copy that the network cannot alter.

"Tested by restore." A backup that has run green every night for two years and has never been restored is a hope, not a backup. We have restored test files from supposedly healthy backups and found empty folders, corrupt archives and a backup job that had been quietly backing up the wrong drive since a server move. Restore something monthly, log it, and the question answers itself.

"Guest Wi-Fi separated." In hospitality and retail this is the one that is most often answered yes when it is no. "Separated" does not mean the guest network has a different password. It means a customer's phone on the guest Wi-Fi cannot reach the tills, the server, the CCTV recorder or the office PCs, and you can show a diagram proving it. On a flat network with one unmanaged switch, it can reach all of them. We wrote about the same problem from the till's point of view in why your EPOS supplier blames the network.

What to fix first

If several answers are no, do not try to fix everything before the renewal date. Insurers and clients accept a plan. In order of how much risk each one removes for the effort:

1. Multi-factor authentication on every account, everywhere. Free, fast, and the biggest single reduction in risk.
2. Close any Remote Desktop exposed to the internet, and put remote access behind a VPN or a managed tool.
3. Make one backup copy unreachable from the network, and test a restore.
4. Turn on automatic patching for workstations and servers, and find out when the firewall and switches were last updated.
5. Separate the guest Wi-Fi onto its own network.
6. Get the documentation written: diagram, asset list, patching and backup policies. Half the questionnaire is answered by those four documents.

Do those six and you have also done most of the work for Cyber Essentials, which is worth having because it turns "we do the basics" into a certificate a client or insurer can see.

Where your IT provider comes in

Every answer on the questionnaire should come from documentation your IT provider already holds. The network diagram, the patching policy, the backup restore log, the MFA coverage report, the firewall configuration: these are the normal outputs of a managed support contract, not a consultancy project bolted on when the form arrives.

So the most useful thing a questionnaire can tell you is about your provider. If they can produce the evidence and draft the answers in an afternoon, you are in good hands. If the form prompts a quote for a "security review", the documentation did not exist and the contract was not doing what it said.

We produce those documents at onboarding as standard, which is covered on our IT support page, and the network side, the managed switches, firewalls and segmentation that most of the questions turn on, is what our network infrastructure page describes. If the honest answer to several questions is no, we would rather tell you that with a prioritised plan than give you a reassuring paragraph, because the person who reads that paragraph later is a claims investigator.