9 Things to Do After Your Cyber Insurance Renewal Questionnaire Arrives

1. Treat every line as a representation the carrier can test after a claim

In July 2022 Travelers Property Casualty Company of America sued International Control Services in federal court in Illinois after a ransomware event at the manufacturer that May. Travelers alleged the company "only used MFA to protect its firewall, and did not use MFA to protect any other digital assets," while its application and a separate MFA attestation, signed that March, said otherwise. The policy had incepted on April 4, 2022. On August 26, 2022 the two sides jointly asked the court to declare the policy "null and void, from its inception," with no coverage available for past, present, or future claims. Each side paid its own costs.

Read that timeline again by the calendar. The application was signed in March, the policy started in April, the attack hit in May, and by late August there was no policy at all and never had been. The form, not the firewall, is what decided it.

Before anyone types an answer, write one sentence at the top of page one: every answer here is a fact we will have to prove to a forensic examiner. That single reframe changes how the technical questions get answered, and it is free.

2. Find out who signs the attestation, and get that person in the room first

Cyber applications usually carry two signatures: an officer of the company, and whoever is responsible for network and information security. In the Travelers filing, the application and the MFA attestation were both signed by the company president. If an IT provider fills in the technical lines and an owner signs the form without walking through them, the owner has just certified facts nobody compared notes on.

Put one 60-minute session on the calendar with three people in it: the owner or officer who will sign, the person who actually runs the network, and the broker on the phone. In onboarding audits we routinely find that the attested control set and the deployed control set are not the same document. It is almost never dishonesty. It is that the person who knows the network and the person who signs the form have never sat down together.

3. Get two dates from your broker in writing, and work backward from the second one

Ask for both: the date the broker needs the completed questionnaire, and the last date a changed answer can still affect the quote. Brokers will give you the first one unprompted and rarely volunteer the second. The second is the one that matters. It tells you whether a control you can stand up in 9 days is worth standing up now or worth scheduling for next quarter with a disclosure attached.

Write both dates at the top of the form next to your sentence about forensic examiners. Then count backward: evidence gathering, gap decisions, review session, signature. If that arithmetic does not fit, you have learned something useful on day one instead of day twenty.

4. Give every question an owner before anyone starts typing

Print the questionnaire and number every question. Then assign each one to a person. The questions sort into three columns, and nobody answers another person's column.

• The person who runs the systems takes MFA, EDR, patching, backup, email security, logging, and remote access.
• The owner or officer takes prior incidents and claims, revenue and record counts, funds-transfer procedures, vendor and client contract obligations, and anything asking what the business does.
• The broker takes policy structure: sublimits, waiting periods, prior-acts language, and what the last policy actually said.

The questions that sink a submission are usually not the technical ones. They are the business ones, and they get answered badly when whoever is holding the form guesses. A wire-transfer verification question answered by an IT technician who has never seen the accounting workflow is a representation with nobody behind it.

5. Attach a dated artifact to every yes

Pull each one this month, not last year. Dates on the exports are part of the point.

• MFA coverage: the identity provider's per-user MFA or sign-in report showing enrollment and enforcement, plus a written count of every account excluded and why.
• EDR deployment: the security console's device list set next to the asset inventory, with the difference between the two numbers explained rather than ignored.
• Backups: the record of the last successful restore. What was restored, by whom, on what date, and how long it took.
• Patching: the patch report for the most recent full cycle, with named exceptions and the reason each one is excepted.
• Security awareness training: completion records with names and dates. A purchase receipt for a training platform is not a completion record.
• Incident response plan: the document itself, carrying a revision date and working phone numbers, plus the date it was last exercised.
• Email security: the tenant configuration export covering the specific settings the question names, not a general statement that the tenant is hardened.

Underwriters increasingly want to see this material rather than a checkbox. Broker Lockton's read on the Travelers case is that cyber applications have become longer and more complex, and that answering them takes real care and a thorough understanding of what is being asked. That is a polite way of saying the form is now the audit.

6. Read the scope word in every question, because that is where a true answer becomes a wrong one

The scope word is the qualifier that widens or narrows what is being asked: all, any, every, privileged, administrative, remote, external, company-owned, immutable, tested. Multi-factor authentication on a firewall is a true statement about a firewall. It is not an answer to a question that asked about administrative and privileged access to the network. That gap is the entire Travelers case.

• "All remote access" includes the vendor VPN, the ERP support tunnel, and the legacy RDP jump box somebody kept for one application.
• "All privileged accounts" includes service accounts, local administrator accounts nobody logs into, and the break-glass account in the safe.
• "Every endpoint" includes personal phones reading company mail, the shop-floor PC on an unsupported operating system, and the two laptops that live in trucks.
• "Immutable backups" means the copy cannot be altered or deleted inside the retention window by anyone, including your own domain administrator. A backup nobody has happened to delete is a different claim.
• "Tested" means a restore was performed and the restored data was verified. A backup job reporting success is not a test.

The identity questions carry the most weight in the file and the most exposure in the answer. Sophos' State of Ransomware 2026, a survey of 2,158 IT and security decision-makers across 17 countries, found 79% of ransomware attacks originate from compromised identities, and that only 34% of organizations with 100 to 250 employees stopped the attack before encryption or extortion, against 46% at 3,001 to 5,000 employees. Smaller companies get fewer chances to catch it, which is exactly why the underwriter is reading the MFA scope word closely.

7. Answer the recovery questions with a restore date and the second copy's address

The backup section usually asks three things: is there an off-site copy, is it immutable, and has it been tested. A Houston business should answer a fourth question the form does not ask. Where is the off-site copy, geographically?

A second copy sitting in a facility on the same bayou as the office satisfies the word off-site and fails the event. NOAA's National Hurricane Center puts the Atlantic peak at September 10, with most activity between mid-August and mid-October, which is the same stretch of calendar when a January renewal file gets assembled. CinchOps keeps client backups geo-redundant and stored outside the Gulf Coast flood zone, restore-tested on a schedule rather than assumed, because the questionnaire's definition of off-site and a storm's definition of off-site are not the same standard.

So answer with the date of the last verified restore, what was restored, and how long it took, then add where the second copy lives. A schedule is a plan. A restore date is evidence. From Katy to Sugar Land to Cypress, the businesses that answer this one cleanly are the ones that tested a restore in the spring rather than hoping in the fall.

8. Route every remaining gap to close, disclose, or renegotiate, then tell the broker which

Close it when the fix is days rather than months: enforce MFA on the last exempted accounts, push EDR to the machines the console does not see, run the restore test. Deploy it, then date the evidence. The answer becomes a yes with an artifact behind it.

Disclose it when the work is real but lands after the binding date. Answer no, and attach a one-page plan naming the control, the person who owns it, and the completion date. A documented no reads very differently from a bare no, and unlike an optimistic yes it survives a forensic review.

Renegotiate when the control is not arriving this cycle at all. Ask the broker about a sublimit, a coverage condition, or a later effective date for that section. Coverage adjusts and the policy survives, which beats a policy that turns out to have never existed.

Then get the story in front of the person pricing it. Marsh's Global Insurance Market Index put US cyber insurance rates down 2% in Q2 2026 and global cyber rates down 4%, the 12th consecutive quarter of declines. A soft market does not reward a thin submission; it rewards the one that documents what changed. Send a single-page summary of what moved since last year with the artifacts attached, and confirm it reached the underwriter rather than stopping in the broker's inbox.

9. File the answer pack and put next year's dates on the calendar the same day

Save the exports, the submitted questionnaire, the remediation plans, and the two dates the broker gave you, all in one place. Then open the calendar while the work is still fresh and set a reminder for 10 months out. Not for the renewal date. For the day you start the next one.

In Texas there is a second payoff for the same work. Senate Bill 2610, effective September 1, 2025, bars exemplary damages against a business with fewer than 250 employees that maintained a cybersecurity program conforming to a recognized framework. The statute scales with headcount: password policies and employee training under 20 employees, the CIS Controls Implementation Group 1 at 20 to 99, and a recognized framework such as NIST or the ISO/IEC 27000 series at 100 to 249. It does not touch compensatory damages or regulatory enforcement, so it is a partial shield rather than a blanket one. It is also built out of the same evidence the questionnaire just made you produce.

Ransomware is still what the underwriter is pricing. The Verizon 2026 Data Breach Investigations Report found 48% of breaches involve ransomware and 31% start with software vulnerabilities rather than stolen passwords. Those two numbers are why the patching questions sit right next to the identity questions on the form, and why the answer pack is worth keeping current between renewals rather than rebuilt under deadline.