Cyber Insurance Application Questions: Why Carriers Ask About MFA and Backups

Cyber insurance carriers ask about multifactor authentication and backups to assess how easily an attacker could enter your systems and how you would recover afterward. Your answers help underwriters decide whether to offer coverage and on what terms, with requirements varying by insurer, revenue size, and industry. Treat the application as a factual statement of your current controls, not a list of improvements you hope to make.

What does a cyber insurance application actually ask?

A cyber insurance application asks what your business does, what information you hold, and which security controls you actually use. For owners and CFOs, the job is to coordinate accurate answers across finance, operations, and IT rather than guess at technical details.

Expect questions about revenue, services, sensitive data types, record counts, prior incidents, and reliance on outside technology providers. The form may also ask whether controls cover every relevant account or device, not just whether you own a particular security product.

Your cyber liability coverage needs depend on these exposures. If you sell technology services, distinguish your own cyber losses from customer allegations about your work; the cyber liability versus tech E and O guide explains that distinction.

Why do underwriters ask about MFA on different accounts?

Underwriters ask about MFA in different places because protecting one login does not protect every route into your business. Multifactor authentication, or MFA, requires evidence from different categories, such as a password plus an authenticator approval, rather than a password alone.

Many carriers commonly ask about these three areas separately. Have IT confirm which systems and users are included, how enforcement works, and whether exceptions exist.

• Email: Can an attacker enter an employee mailbox using only a stolen password? Check administrator access and accounts outside your main email system too.
• Remote access: Does MFA protect your virtual private network, remote desktop tools, and other routes used to reach company systems from outside?
• Privileged accounts: Are administrator accounts, which can change settings or grant access, protected? Include accounts used by your outside IT provider.

Do not answer yes to an all-accounts question because most employees use MFA. Disclose any exceptions and ask your broker how to present them to the underwriter.

Why do carriers ask where backups live and whether restores work?

Carriers ask about backup separation and restore testing because a backup is useful only if it survives the incident and can restore usable operations. A copy accessible through the same compromised network or administrator credentials may not provide the separation the application describes.

The form may distinguish offline copies, air-gapped copies isolated from network access, and immutable backups, which cannot be changed or deleted during a defined retention period. These approaches are not interchangeable; ask IT to describe your actual setup rather than select whichever term sounds strongest.

Expect questions about backup frequency, protected systems, access controls, and your latest restore test. A successful backup notification is not evidence that you restored a working system.

Explain how quickly you could recover critical operations and how much recent data you could lose between backups. Restoring a file is different from rebuilding billing, customer access, or a production environment, so document what your test actually demonstrated.

What other security controls should you be ready to explain?

You should be ready to explain device monitoring, patching, email protection, employee training, incident response, and payment verification. Many carriers ask how these controls operate, not simply whether a written policy exists.

• Device monitoring: Endpoint detection and response monitors devices for suspicious activity and supports investigation and response. Confirm which devices are covered and who acts on alerts.
• Patching: Describe your update cadence, how you prioritize urgent vulnerabilities, and how you handle systems that cannot be updated promptly.
• Email filtering and training: Explain how you screen malicious messages and train employees to spot suspicious requests. Verify what training actually occurred.
• Incident response: Identify your response plan, decision makers, outside support, and a way to reach them if company email is unavailable.
• Payment verification: Explain callbacks using independently verified contact details and dual approval for wire transfers and vendor bank-detail changes.

Payment controls are especially relevant to social engineering and funds-transfer fraud coverage, which is often subject to a sublimit, a smaller coverage cap within the policy. Do not assume a broad cyber limit applies to a fraudulent payment; check the specific coverage, conditions, and exclusions.

Some carriers also scan your domain for externally visible vulnerabilities. Ask IT to investigate findings and explain discrepancies rather than assuming a scan proves all internal controls work.

What happens if you answer no to a control question?

A no answer can lead to follow-up questions, coverage conditions, exclusions, smaller sublimits, higher pricing, or a declined application. The outcome depends on the carrier and program, your industry, revenue size, and the specific gap.

Ask whether the control is required before coverage can begin or whether the carrier will consider a documented remediation timeline. If a deadline is offered, get the required action, completion date, evidence, and consequences of missing it in writing.

A planned fix is not a completed control. Compare the actual quote terms with your operations, and do not assume implementing one improvement guarantees eligibility, broader coverage, or lower pricing.

Why do accurate application answers matter at claim time?

Accurate answers matter because the application typically forms part of your insurance contract, and material misstatements can jeopardize a claim. Applications are typically signed by an officer, even when IT supplies the technical information.

Have your internal IT lead or outside provider review the exact questions and sign off on the technical answers before an officer signs. If wording is unclear, seek written clarification through your broker instead of stretching the meaning of yes.

Keep dated supporting records and the submitted application. Correct errors promptly and tell your broker about material changes before coverage begins; ask what ongoing notification or control-maintenance duties the proposed policy contains. Claim consequences depend on the facts, policy wording, and applicable law.

How can you prepare before completing the application?

Prepare by gathering evidence, assigning owners, and separating controls that work today from work still underway. Use this checklist before you submit or renew.

1. Collect revenue, service descriptions, data types, record counts, and prior incident details.
2. Map MFA across email, remote access, and privileged accounts, including exceptions.
3. Document backup separation, retention settings, the last restore test, and demonstrated recovery time.
4. Confirm device coverage, alert ownership, patching cadence, email filtering, and completed training.
5. Review the incident response plan and independently verified payment callback and approval procedures.
6. List gaps with responsible owners and realistic completion dates; do not mark pending work complete.
7. Obtain IT sign-off, review quote restrictions, and retain the signed application and supporting evidence.

Where can a broker help with your application?

A broker can help clarify application wording, present documented gaps, and compare the conditions attached to competing quotes. Velora Risk Partners can help connect those insurance questions to your business priorities while your IT team verifies the controls. Contact Velora Risk Partners to discuss your application and coverage options.

Frequently asked questions

Does turning on MFA for employee email satisfy a cyber insurer?

Email MFA alone may not satisfy a cyber insurer because applications commonly ask about remote access and privileged accounts separately. Requirements vary by carrier, revenue size, industry, and program. Have IT verify enforcement across the systems named in your application, document exceptions, and ask your broker to clarify any wording before you answer yes.

Can cloud storage count as a backup for cyber insurance?

Cloud storage may be part of your backup arrangement, but storing files online does not by itself establish that you meet an insurer's backup requirements. Ask IT whether copies are separate from production access, protected from alteration or deletion, and recoverable after an incident. Describe your setup accurately and confirm the carrier's interpretation of the application wording.

Can you obtain cyber coverage while security improvements are unfinished?

You may be able to obtain cyber coverage with unfinished improvements, but availability and terms depend on the carrier and program. A carrier may require completion before coverage begins, impose restrictions, consider a remediation deadline, or decline. Report the current state honestly and get any agreed timeline, evidence requirements, and coverage consequences in writing.

Who should review the technical answers before an officer signs?

Your internal IT lead or outside technology provider should review and sign off on the technical answers before an officer signs the cyber application. Finance and operations should verify business information, data handling, and payment procedures. Keep the exact submitted answers and dated supporting records because the application typically becomes part of your insurance contract.

Does a cyber policy automatically cover a fraudulent wire transfer?

A cyber policy does not automatically cover every fraudulent wire transfer. Social engineering and funds-transfer fraud coverage depend on the policy wording and are often subject to smaller limits, exclusions, or verification requirements. Review the relevant coverage with your broker and accurately describe callback and dual-approval procedures rather than assuming your main cyber limit applies.