The cybersecurity insurance renewal questionnaire your broker sends each year has quietly become the most honest document in your IT program. Underwriters built it to price risk — which means every question on that form is grounded in actuarial data about what actually causes losses. That makes it a sharper benchmark for your IT vendor’s real-world performance than any marketing deck or service-level agreement they will ever hand you. This guide walks you through the logic question by question so you can use the renewal as a live audit, not a paperwork exercise.
Why the Cybersecurity Insurance Renewal Questionnaire Has Become the Real Benchmark
Insurance carriers have paid out billions in ransomware, business email compromise, and data-breach claims over the past several years. They know which control failures show up in losses and which ones do not. When they ask a yes-or-no question about multi-factor authentication on email, they are not being academic. They have the claim data. A “no” answer materially changes your premium or your coverage eligibility because it predicts loss.
That same predictive power is exactly what you need as a buyer of IT services. You are not grading your vendor on a rubric someone invented. You are asking the same questions that sophisticated risk analysts ask when real money is on the line. If your IT firm has not delivered a “yes” on these controls, you have an accountability conversation in front of you — not a theoretical one.
The CISA ransomware guidance and the underwriting requirements from major carriers have converged on a remarkably similar short list. The controls are not secret. Your vendor knows them. The only question is whether they have implemented them. Reviewing your cybersecurity insurance renewal questionnaire alongside your managed IT services agreement is the fastest way to close that gap.
Question Block: Multi-Factor Authentication
Nearly every renewal form asks some version of: “Is multi-factor authentication enabled on email, VPN, and remote access?” Some ask whether it covers all users or only administrators. Some ask whether it extends to cloud applications.
What good looks like: every user who can access email, file storage, or any business application from outside the office requires a second factor beyond a password. No exceptions for executives, no exceptions for shared accounts, no exceptions for people who find it inconvenient. Your IT firm should be able to show you a configuration report — not just say “yes.”
What a red flag looks like: your IT firm says multi-factor authentication is in place but cannot tell you which accounts are excluded. Or it is on email but not on the file-sharing platform. Or the answer on the form is “yes” and you genuinely do not know how they got there.
The audit question to ask your vendor directly: “Show me the report of every active user account and whether multi-factor authentication is enforced. Which accounts, if any, are excluded — and why?”
Question Block: Backups and Recovery Testing
Carriers typically ask: “Are backups maintained offline or isolated from the production network? Are restore tests performed, and how often?” This is the question that separates vendors who talk about backup from vendors who actually practice recovery.
What good looks like: backups run on a documented schedule, a copy exists that ransomware on your network cannot reach, and a test restore has been completed in the past twelve months with a documented result. You should have seen a test-restore report — even a brief one.
What a red flag looks like: your vendor says “yes, we back you up” but cannot point to a test restore record. Or backups run to a drive mapped on the same network as production. Or the last confirmed restore test was years ago.
The audit question: “Send me the last backup test report. What did we restore, when did we do it, and how long did recovery take?”
Question Block: Endpoint Protection
The form will ask whether you use an advanced behavior-based endpoint protection tool rather than traditional antivirus alone. The distinction matters: traditional antivirus matches known threat signatures, while modern protection monitors behavior and can catch attacks that have never been seen before.
What good looks like: every device that touches your environment — laptops, desktops, servers — is covered by a behavior-based protection platform. Your IT firm should be able to name the platform and show coverage percentage. Less than 100% coverage is a gap worth a conversation.
What a red flag looks like: your vendor names the tool but cannot confirm full coverage. Or the tool was deployed but the management console shows devices that have not checked in recently.
The audit question: “What percentage of our devices are covered by active endpoint protection right now? Are there any devices not covered, and why?”
Question Block: Patching and Vulnerability Management
Carriers ask how quickly critical patches are applied after release. The threshold most carriers use is fourteen to thirty days for critical vulnerabilities. This is a purely operational question with a measurable answer.
What good looks like: your IT firm runs a documented patching cycle, critical patches go out within two weeks of release, and there is a report showing patch compliance across your environment. A vendor who takes this seriously will share a monthly summary without being asked. The NIST Cybersecurity Framework identifies patch management as a foundational “Protect” function — and insurers agree.
What a red flag looks like: patching happens “when we can get to it.” Or the vendor patches servers but not user workstations on the same schedule. Or no formal patch report has ever been shared with you.
The audit question: “What is the current patch compliance percentage across our environment? When did we last apply critical updates, and is anything outstanding right now?”
Question Block: Privileged Access and Admin Accounts
This section of the renewal questionnaire asks whether administrator accounts are separated from regular user accounts, and whether elevated access is controlled and logged. This is one of the most frequently overlooked controls in small and mid-size business environments.
What good looks like: people in your organization who need elevated access to systems use a separate account for those tasks — not their everyday email login. Your IT firm’s own access to your environment is similarly controlled and logged, with a clear record of who has admin-level access and why.
What a red flag looks like: your IT team uses a single shared admin password. Or staff accounts have local administrator rights on their laptops “for convenience.” Or your IT vendor cannot tell you how many accounts in your environment have elevated privileges.
The audit question: “How many accounts in our environment have administrator or elevated privileges? How is your team’s own access to our systems logged and reviewed?”
Question Block: Email Security and Phishing Controls
Business email compromise is consistently the top source of financial losses in cyber claims. Carriers know this — which is why the questionnaire typically asks about email filtering, anti-spoofing controls, and employee phishing training. Our cybersecurity practice treats email as the primary attack surface for most businesses, because it is.
What good looks like: outbound spoofing of your domain is blocked by properly configured authentication records so attackers cannot impersonate your company. Inbound email filtering catches malicious links and attachments before they reach users. Your staff has seen a simulated phishing test in the past twelve months.
What a red flag looks like: your vendor says email is “protected” but has never run a simulated phishing test. Or your domain has no anti-spoofing records configured — something you can verify yourself with a free lookup tool in about two minutes.
The audit question: “Can you show me that our domain has proper anti-spoofing records in place? When did we last run a phishing simulation, and what was the click rate?”
Question Block: Incident Response and Detection
Later sections of the renewal form ask whether you have a documented incident response plan and whether someone is monitoring your environment for threats around the clock. These questions are about what happens when something goes wrong — not just what is in place to prevent it.
What good looks like: there is a written incident response plan, it has been reviewed in the past year, and your IT firm can describe in plain language the first three steps they would take if ransomware was detected in your environment tonight at 11 PM. Monitoring covers your environment at all hours — not just during business hours, when attackers often specifically choose to strike.
What a red flag looks like: your vendor says “we’d handle it” without being able to describe the process. Or the incident response plan was written once and never updated as your environment changed. Or monitoring only covers business hours.
The audit question: “Walk me through exactly what happens in the first hour if ransomware is detected in our environment. Who gets called, what gets isolated, and who makes decisions?”
Red Flags to Watch for When You Share the Form with Your IT Firm
How your IT firm responds to the cybersecurity insurance renewal questionnaire itself tells you something. A vendor who has implemented these controls properly should answer quickly, with documentation. Watch for these patterns:
- They answer yes to everything without offering to show you supporting evidence
- They ask you to “just check yes” without walking you through what each answer means
- They treat the questionnaire as a compliance exercise rather than an accurate description of your environment
- They get defensive when you ask follow-up questions based on specific line items
- They cannot produce a single report or configuration document to back up any answer
A vendor with nothing to hide will welcome the audit. We have worked with businesses coming from previous IT relationships where the cybersecurity insurance renewal questionnaire was the moment they first realized answers were being checked without any documentation behind them. That is not a problem you want to discover during a claim denial.
How to Decide What to Do With What You Find
After you run the cybersecurity insurance renewal questionnaire as a vendor audit, you will land in one of three places. The first is confidence — your vendor answered every question with documentation, and you know exactly where your environment stands. The second is gaps with a plan — there are items that need work, your vendor acknowledges them, and there is a clear timeline to close them. The third is concern — answers were vague, documentation was absent, or the response to your questions felt evasive.
The first scenario means your IT program is doing what you are paying for. The second is recoverable if the plan is real and the timeline is short. The third means you are carrying risk you may not fully understand — and a second opinion from an independent firm is worth your time before the next renewal cycle.
We built our practice on exactly this kind of accountability. Zero client breaches across every managed client we have served since 2004 is not a coincidence — it is what happens when the controls on the insurance questionnaire are not a checklist but a daily operating standard. If your current vendor cannot back up their “yes” answers with evidence, that gap is worth understanding clearly before an underwriter or an attacker finds it first. Book a Free Cybersecurity Strategy Call and we will walk through every major question block on the current renewal form with you.
Let’s Talk About Your IT Strategy
If anything in this post raised a question about your own environment, the fastest path to an answer is a 20-minute strategy call. We’ll look at your specific situation and tell you what we’d actually do about it.