The Cyber Insurance Questionnaire: What a Small Business Is Asked

A small business applying for cyber insurance, or renewing it, receives a questionnaire. The boxes look simple: "Do you use multifactor authentication?", "Do you have backups?". The answers matter more than they seem. Here is what insurers often ask, according to public sources, and why it is better to answer with evidence.

What cyber insurance covers

Get Cyber Safe, with the Insurance Bureau of Canada, describes what cyber insurance can cover: data breaches, extortion such as ransomware, technology disruptions, and costs such as legal advice, notifying the people affected, investigation and data restoration (Get Cyber Safe). The same source points out that an endorsement can also exclude coverage: every contract has to be read.

What the insurer often asks

Again according to Get Cyber Safe, the insurer wants to know about your operations, the date of your last audit, the data you collect and the measures that control access to it (Get Cyber Safe). The Insurance Bureau of Canada’s checklist is more precise; it names the questions you could be asked when applying (Cyber Savvy Canada):

• multifactor authentication;
• backups;
• software updates;
• anti-virus and firewall;
• encryption;
• employee training.

The same organization’s self-assessment adds an incident response plan, and a business continuity plan tested within the past twelve months (Cyber Savvy Canada).

The same controls, from the Canadian Centre

These questions overlap the baseline cyber security controls the Canadian Centre for Cyber Security proposes for small and medium organizations: a written incident response plan, automatic updates, protection against malware, two-factor authentication for important accounts, training, offline backups tested regularly, and limited administrator privileges (baseline controls). The same document even suggests considering a cyber security insurance policy.

For two of these boxes, our articles go further: mandatory MFA in Microsoft 365 and the 3-2-1 backup rule.

Before you tick a box

For each question, the right answer is the one you can show. For multifactor authentication, the list of accounts that have it, administrator accounts included. For backups, the date of the last restore test; the Canadian Centre recommends testing backups regularly (baseline controls). For updates, the state of the workstations, the servers and the firewall. For the incident response plan, a written document the team knows. If an answer is "no" or "partly", better to know it before the insurer does.

Why answer with evidence

In Quebec, the Civil Code requires declaring the facts that influence the risk, including in answer to the insurer’s inquiries (article 2408). A misrepresentation can nullify the contract at the insurer’s instance (article 2410); absent bad faith, in damage insurance, the indemnity may be reduced proportionally (article 2411) (Civil Code of Québec). The Autorité des marchés financiers puts it this way for the public: a false statement can cost you your right to be compensated (AMF). The UK NCSC says it for cyber insurance: if you claim security measures are in place when they are not, the insurer may not be obliged to pay (NCSC). This is a summary, not legal advice.

The trap is rarely a lie. It is a box ticked in good faith: "yes, we have multifactor authentication", when a forgotten administrator account does not; "yes, we have backups", when nobody has ever tried restoring one. And the Civil Code also requires reporting, during the contract, changes that increase the risk (article 2466).

What MPJM does, and does not do

MPJM does not set insurance premiums, and will never promise you they go down. Our security analysis and MPJM certificate checks the ten controls cyber insurers check, with for each one what we found and what needs fixing, so you can answer your insurer with evidence rather than ticked boxes.

Frequently asked questions

What does a cyber insurer ask a small business?

Its operations, its last audit, the data it collects and the measures that control access to it; the Insurance Bureau of Canada’s list adds multifactor authentication, backups, software updates, anti-virus and firewall, encryption and training.

What is the risk of answering the questionnaire wrongly?

In Quebec, a misrepresentation can nullify the contract at the insurer’s instance; absent bad faith, in damage insurance, the indemnity may be reduced proportionally (Civil Code, articles 2410 and 2411).

Does the Canadian Centre for Cyber Security mention insurance?

Its baseline controls for small and medium organizations suggest considering a cyber security insurance policy, alongside the incident response plan, backups and updates.

What now?

You have an insurer’s questionnaire on your desk and you are not sure of your answers? Ask for MPJM’s free network analysis, offered to businesses with 10 or more workstations.

P.S. Sixteen questions, eight domains, a clear picture of your strengths and blind spots: start the assessment.