The Renewal Moment
The Cyber Insurance Questionnaire,
Answered Honestly.
The renewal is sitting in your inbox. It asks about MFA, endpoint protection, backups, training, and an incident response plan, and it wants a signature under all of it. We sit with you, complete the questionnaire, and back every yes with documentation we already wrote.
Why This Page Exists
'I Couldn't Answer the Insurance Questionnaire Honestly.'
That sentence, or a version of it, is how most of these conversations start. A law firm's malpractice carrier adds a cyber supplement. A CPA firm's renewal doubles in length. Somebody in the office is handed a form full of terms like "endpoint detection and response" and "network segmentation," a signature line, and a due date. The honest answers are uncomfortable, and the comfortable answers are misrepresentations that give the carrier a reason to deny the claim on the worst day of your professional life.
There is a third option. Put the controls in first, document them as you go, then answer the questionnaire with receipts. Carriers now deny claims when MFA and documented controls are missing, so the paperwork is not a formality. It is the difference between a covered incident and a letter explaining why you are not covered. Our job is to make your application something you can sign honestly, and to be sitting next to you when you sign it.
The Questions
What the Questionnaire Actually Asks
Five questions on nearly every application, what they really mean, and how we get you to an honest yes.
"Is multi-factor authentication enforced on all email and remote access?"
What It Means
The most common renewal requirement, and the most common denial reason after a claim. "Mostly" and "for the partners" do not count. Carriers want MFA on every account, and they increasingly verify it.
How We Get You to Yes
We roll out MFA firm-wide, including the accounts everyone forgot about, and document the enforcement policy so your yes has a paper trail.
"Do you run endpoint detection and response (EDR) on all devices?"
What It Means
Carriers now name this control on most applications. Traditional antivirus alone is a no, and a no here can mean a declined application or a doubled premium.
How We Get You to Yes
Enterprise EDR runs on every machine we manage, monitored around the clock by a 24/7 operations center with 400+ analysts through our SOC partnership. You check yes, and we hand your carrier the documentation that proves it.
"Are backups encrypted, separated from your network, and tested?"
What It Means
Untested backups are the answer that fails the follow-up question. Carriers ask when you last restored from them, because ransomware payouts hinge on it.
How We Get You to Yes
Encrypted backups with restores actually tested, and the test dates logged where you can point to them.
"Do employees receive security awareness training?"
What It Means
Most breaches start with one email, and carriers price accordingly. "We sent a memo once" is not a training program.
How We Get You to Yes
Ongoing phishing simulation and training for your staff, with completion records you can attach to the application.
"Do you have a written incident response plan?"
What It Means
The question that exposes template PDFs. A plan nobody has opened is a plan the adjuster will pick apart after a claim.
How We Get You to Yes
A written plan built around your actual systems and people, with named roles and our 1-hour emergency response commitment in writing behind it.
Not sure where you stand today? Our free risk assessment tool walks the same ground the carriers do, in about five minutes.
Who This Is For
Firms Whose Signature Is a Representation
The renewal problem hits professional firms hardest, because a signed application is held to a professional's standard.
For Law Firms
Your malpractice and cyber carriers ask the same questions your clients’ outside counsel guidelines do, and carriers now deny claims when MFA and documented controls are missing. An application you sign is a representation. We make sure it is an accurate one.
How we serve law firms →For CPA Firms
Your renewal lands in the same season as the PTIN attestation asking whether you have a WISP. Same controls, same honesty problem, same fix: a security program that actually exists, documented by the people who built it.
How we serve accounting firms →Every control we document is a control we run: named tools, a 24/7 operations center, and a 1-hour emergency response in writing. The full stack is explained in plain English on our security page.
Renewal Questions
Asked at Every Renewal
What exactly do you do when our renewal arrives?
We sit with you and complete the questionnaire, and every yes is backed by documentation we already wrote. That is the deliverable. You are not left interpreting insurance language alone, and you are not signing anything we cannot prove.
Our renewal asks for MFA everywhere. How fast can that happen?
For most small firms, MFA can be enforced across email and remote access within days, not months. The slower part is cleaning up shared logins and forgotten accounts, which we handle in the first weeks. If a deadline is looming, tell us the date and we work backward from it.
What happens if we answer yes to things we do not have?
A misrepresentation on the application gives the carrier grounds to deny the claim after a breach, which is the exact moment you need the policy to pay. That is the whole reason we exist in this process: to make yes the honest answer before you sign, not to help you word your way around a no.
Can you help even if we were already declined or premiums jumped?
Yes, and that is a common starting point. A declination usually names the missing controls. We implement them, document them, and you reapply with a stronger application. Clients often find the premium math alone justifies the work.
Is this a one-time project or ongoing?
The controls carriers ask about are the same controls that stop breaches, so they need to stay running: monitoring, backups, training, patching. We maintain them year-round, which means next year’s renewal is an afternoon, not a scramble.
See the full security stackGet Your Firm's Free Risk Assessment
Bring the questionnaire to the call. A confidential 20-minute review of what your carrier asks for and where you stand today.
Confidential · No obligation · (470) 785-3035