NetworkDefender
NetworkDefender
Most owners open a cyber insurance application expecting a normal business insurance form. What they get is a detailed questionnaire about email security, backups, multi-factor authentication, employee training, wire transfers, endpoint protection, and incident response.
The insurer may ask whether you have a control, how broadly it is deployed, who monitors it, and whether you have tested it. A "yes" from three years ago may no longer describe what is running today.
Requirements vary by carrier, policy, industry, revenue, and coverage limit. Still, the same control areas appear repeatedly. If your Wisconsin business is applying for cyber insurance or preparing for renewal, you should be able to answer these questions accurately and support the answers with evidence.
The questions look simple because many are checkboxes. The work behind them is not.
At-Bay's June 2026 cyber insurance application is 15 pages. It asks what sensitive information the applicant stores, whether it is encrypted, whether written data-handling policies exist, how backups are separated, whether critical backup copies are immutable, and whether the business continuity plan was tested within the last year.
It also asks whether MFA is enforced on all email and remote access, which endpoint detection and response product is installed, who monitors it, and which inbound email security product is used.
These are not questions an owner should answer from memory. Someone needs to check the systems, confirm the scope, and document what is true when the application is signed.
MFA is the first place to look because email and remote access sit directly in the path of account takeover and ransomware.
The word that matters is "enforced." Microsoft 365, Google Workspace, a firewall, or a business application may support MFA without requiring every user to enroll. Email may be protected while the remote access tool, backup console, domain registrar, or administrator account still accepts only a password.
If the application asks whether MFA is enforced on all email access, "most employees use it" does not support a yes answer. Pull the enrollment and policy reports. Confirm coverage for employees, administrators, remote access, cloud services, and outside vendors that can reach your systems.
MFA methods matter too. NIST's small-business MFA guidance identifies FIDO authenticators paired with WebAuthn as the most common phishing-resistant option widely available today. An authenticator app is still better than password-only access, but administrative accounts deserve stronger protection than text messages when the platform supports it.
Buying endpoint detection and response software does not prove that every device is protected.
An insurer may want the product name, where it is installed, and who responds to alerts. At-Bay's application distinguishes between EDR monitored around the clock by a third party, monitored internally, watched only during business hours, and deployed without active monitoring. Those arrangements are materially different even though each business could say it "has EDR."
Compare your device inventory with the endpoint security console. Look for computers that stopped checking in, servers excluded because of software conflicts, and personal devices that access business data without being managed.
Then confirm what happens after an alert. A high-severity alert at 2:00 a.m. only helps if it reaches someone who can act. For a small firm without an internal security team, that normally means using a provider that monitors and responds outside normal business hours.
Backups create some of the most misleading answers on insurance applications. A business may pay for Microsoft 365, Google Workspace, a local NAS, or cloud storage and assume the backup question is covered. Sometimes it is not.
If an encrypted or deleted file synchronizes everywhere, the second copy may preserve the damage instead of providing a clean recovery point. A backup should retain previous versions and allow recovery independently of the production system.
At-Bay asks whether backups are offline or air-gapped, stored without network separation, kept in a dedicated cloud backup service, or handled through cloud sync. It separately asks whether critical copies are immutable, meaning they cannot be changed or deleted during their retention window. NIST's backup guidance recommends identifying which backups should be secured offline and testing recovery plans.
You still need evidence that recovery works. A green checkmark on a nightly job proves that the software completed a task. It does not prove that you can restore a server, mailbox, or client file. Test a real restore and record the date and result.
Professional services firms move money and sensitive information through email every day. That makes a compromised mailbox useful even when the attacker never deploys ransomware.
At-Bay's 2026 form asks whether fund and wire transfers above $25,000 require authorization and verification by at least two employees. Your carrier may use a different threshold, but one employee should not be able to change payment instructions based only on an email.
Require employees to verify new or changed banking instructions through a separate channel. Call a known number already on file, not a number supplied in the request. Higher-risk transfers should require a second person to approve them.
SPF, DKIM, and DMARC help other mail systems verify messages using your domain. They do not replace employee training or inbound filtering, but they reduce one part of the impersonation problem.
Training should also be documented. Keep completion records, dates, and topics. An informal reminder during a staff meeting is difficult to prove six months later.
Small businesses often have useful security tools but little documentation. That becomes a problem when an application asks about incident response, business continuity, vendor management, or data-handling rules.
An incident response plan should name who makes decisions, who calls the insurer, who contacts the IT provider, how legal counsel is engaged, and how the business communicates if email is unavailable. It should cover the first actions after a suspicious login, ransomware note, stolen device, or fraudulent payment.
The plan does not need to become a hundred-page manual. A short plan with current names, phone numbers, responsibilities, and recovery priorities is more useful than a generic template nobody has reviewed.
Many insurance controls overlap with legal and professional duties. The FTC Safeguards Rule requires covered financial institutions, including tax preparation firms, to maintain a written security program. IRS Publication 5708 gives tax professionals a Written Information Security Plan template. Wisconsin law requires covered insurance licensees to maintain an information security program, subject to statutory exemptions. Wisconsin lawyers must make reasonable efforts to prevent unauthorized access to client information.
The same MFA reports, risk assessment, incident plan, training records, vendor reviews, and backup tests can support both insurance and compliance documentation.
The riskiest approach is answering according to what the business intended to deploy.
At-Bay requires an authorized representative to declare that the statements are true and complete to the best of that person's knowledge after reasonable inquiry. Its application also states that a misrepresentation, omission, or concealment may be grounds for rescinding the policy.
The exact legal effect depends on the application, policy, facts, and applicable law. The practical lesson is straightforward: do not guess, and do not let someone answer technical questions without verification.
Ask your IT or security provider to review the technical sections. Useful evidence includes MFA enrollment reports, endpoint deployment reports, backup and restore-test results, training records, incident response plans, and a list of systems covered by each control.
If the honest answer is no, document the gap and ask your broker or carrier how remediation affects the application. A known gap can be fixed. An inaccurate answer can create a larger problem after a loss.
Review these controls at least 90 days before renewal. That gives you time to find missing devices, enforce MFA, correct failed backups, write the incident plan, and test recovery.
At 60 days, collect the evidence and review the application with your broker and technical provider. At 30 days, verify that the fixes remain in place and save the supporting records with the completed application and policy.
Do not treat renewal as the only review date. A business can truthfully answer yes in September and drift out of compliance by January after a new employee, server, or remote access tool is added incorrectly. Each control needs an owner and a review schedule.
A cyber insurance application asks whether your controls exist, cover the whole business, and can be proven to work.
The common problem is the gap between the control the owner believes exists and the narrower version actually configured. MFA covers email but not remote access. EDR protects workstations but missed a server. Backups run nightly but nobody tested a restore. The incident plan has the wrong contact information.
NetworkDefender Security helps Wisconsin CPA firms, law firms, insurance agencies, and other small businesses verify these controls before the application is signed. We document what is in place, fix the gaps, and help you give your broker answers that reflect how the business is protected. Contact us to schedule a security review.
Want to see where you stand first? Work through our free Cyber Insurance and Compliance Readiness Checklist. It takes about five minutes and covers the same control areas that appear throughout current cyber insurance applications.