Cyber Security Insurance? The Checklist to Get You Ready

Cyber attacks are everywhere, which is why many companies already protect themselves with a suitable cyber insurance policy.

The right policy mitigates damage and protects your business's survival!

Cybersecurity Insurance Checklist

Qualifying for cover means meeting strict requirements and conditions.

The most important questions and answers will help!

Our checklist shows how best to prepare – because we are committed to your security!

🔹 Is cyber security management established?

A dedicated SOC team or designated security officers ensure clear responsibility and effective monitoring of current incidents as well as their mitigation.

🔹 Do you train your employees regularly on cyber threats?

Regular training helps to avoid human error. Insurers regard this as important protection against phishing and similar attacks, since people are the most frequently exploited vulnerability.

🔹 How do you find and check IOCs (indicators of compromise)?

A systematic approach to detecting and analysing IOCs shows that you tackle threats proactively. A dedicated SOC team is already used and recommended by many Fortune 500 companies.

🔹 Regular audits or risk assessments?

Insurers want to know whether you know your cyber risks. An up-to-date assessment shows that you take your current weaknesses and the improvement of your security seriously. Internal and external audits uncover security gaps and help to secure or close them specifically.

🔹 How do you protect your network as a whole?

This is about the combination of firewalls, IDS/IPS and network segmentation. Insurers want to know how you separate important devices in the network from one another and whether your network is monitored continuously.

🔹 How is third-party access checked?

Third-party access and software in use must be strictly monitored and secured to avoid security gaps. Weak security practices at third parties increase your risk too.

🔹 Cloud services secured according to best practices?

As more and more companies use cloud services, the proper configuration of Azure, AWS, Google Cloud and others is also decisive. It is important to be familiar with the security options currently available and to have actively implemented them.

🔹 Multi-factor authentication (MFA) in use?

Insurers ask how you minimise login-based attacks. MFA is crucial here, especially for accounts with elevated privileges.

🔹 Backups in place and tested regularly?

Insurers check whether you back up your data regularly and test its restoration so that normal operations can be restored quickly after a ransomware attack.

Questions for your insurer:

Qualifying means meeting strict requirements and conditions.

🔹 How do I report a claim, and what evidence is required?

Familiarise yourself with the required procedure, because this answer is decisive in deciding whether an insurer makes the reporting process too cumbersome for you.

🔹 Does your policy also cover ransomware attacks?

Ransomware is widespread. Make sure that payments, downtime and recovery costs are covered where necessary – in the worst case, this can make a substantial difference to your company's liquidity after an incident.

🔹 Can your cyber insurance be reviewed and adjusted?

Clarify whether you can adjust your policy in response to new threats or other changes, so that you are always optimally protected.

🔹 How long do you have to report an incident?

Insurers usually want to be informed relatively early. However, it is to your advantage if you can focus on recovery first.

🔹 When and how is a claim paid out? Is there an excess (deductible)?

Insurers usually offer different levels of cover. From direct assumption of all costs incurred and forensics to possible mitigation of reputational damage, there are many models to choose from. It pays to clarify exactly what applies and to choose a policy that fits your situation.