Your insurer is asking about your security
Renewal forms ask whether two-step sign-in, backups, email protection and an incident plan are in place, and underwriters increasingly want to see the proof. What they ask, and how to answer it truthfully.
What the forms ask
OBF Insurance Group, an Irish broker, lists the controls underwriters expect, and Chubb's Irish proposal forms ask about the same ground. Our guide to the questionnaire sets them side by side.
- Two-step sign-in (MFA) on email, remote access and admin accounts.
- Backups, encrypted, with more than one copy, one kept offline, and a restore tested on a schedule.
- Security updates (patching) done regularly, with a process for it.
- Endpoint detection and response (EDR) on every laptop and desktop.
- Email filtering, with domain controls such as DMARC that stop email forged in your name.
- Staff training, and a written plan for responding to an incident.
A yes needs something behind it
OBF says many underwriters expect proof that the controls are in place, and that failing to show it can mean higher premiums, exclusions or declined cover. A control switched on and never recorded is a yes on the form with nothing behind it.
If your business turned over €3 million or less in its last financial year, and is not part of a group that turned over more, Irish law asks you to answer the insurer's questions honestly and with reasonable care. A dated screenshot, taken before you sign, is how you show you did.
What we do
Protect, from €3,450 up to 10 staff
We set up two-step sign-in, email protection, backups with a tested restore and an incident plan, and prove each with a second scan or a dated document. You get an evidence pack to send to your broker. Protect does not run EDR or patching; if nobody looks after your devices today, that part needs an IT provider.
Read first
- Free toolCyber insurance readiness checkAnswer the questions an insurer asks, and see which answers you can prove.
- What a cyber insurer asks an Irish small businessThe proposal forms, question by question, and how to answer truthfully.
- What it costs to meet cyber insurance requirementsThe controls, what switching each on costs, and published Irish prices for the work.
- Two-step sign-in in Microsoft 365 and Google WorkspaceThe first thing every form asks about.
- Backups that restoreAn offline copy, and a restore test with a date on it.
Start here
The free compliance check looks at your website and email from outside while you answer a few questions, and keeps the result as your compliance record. Or tell us what you have been asked, and we tell you what to do first.