Cyber insurance: The checklist to get you ready

Cyber attacks are everywhere, which is why many companies already protect themselves with suitable cyber insurance. The right policy mitigates damage and protects the survival of the business. To qualify, however, you have to meet strict requirements and conditions. The checklist below shows how best to prepare and which questions to ask your insurer.

Organisation: what insurers ask about security management

Is cyber security management established?

A dedicated SOC team or designated security officers ensure clear responsibility, effective monitoring of current incidents and their containment.

Do you train your employees regularly on cyber threats?

Regular training helps to avoid human error. Insurers see it as important protection against phishing and similar attacks, since people are the most frequently exploited weakness.

How do you find and check IOCs (indicators of compromise)?

A systematic approach to detecting and analysing IOCs shows that you tackle threats proactively. Many large companies run their own SOC team for this.

Are there regular audits or risk assessments?

Insurers want to know whether you know your cyber risks. An up-to-date assessment shows that you take your current vulnerabilities and the improvement of your security seriously. Internal and external audits uncover security gaps and help you secure or close them in a targeted way.

Technology: which safeguards insurers check

How do you protect your network as a whole?

This is about the combination of firewalls, IDS/IPS and network segmentation. Insurers want to know how you separate important devices in the network from one another and whether your network is monitored continuously.

How is third-party access checked?

Third-party access and the software in use must be strictly monitored and secured to avoid security gaps. Weak security practices at third parties increase your risk too.

Are cloud services secured according to best practice?

As more and more companies use cloud services, configuring Azure, AWS, Google Cloud and others properly is decisive as well. You should know the security options currently available and have implemented them actively.

Is multi-factor authentication (MFA) in use?

Insurers ask how you minimise login-based attacks. MFA is crucial here, especially for accounts with elevated privileges.

Are backups in place, and are they tested regularly?

Insurers check whether you back up your data regularly and test its restoration, so that you can return to normal operations quickly after a ransomware attack.

Which questions to ask your insurer

Before you sign, clarify the following five points with your insurer.

How is a claim reported, and what evidence is required?

Familiarise yourself with the required procedure. The answer decides whether an insurer makes the reporting process too cumbersome for you.

Does your policy also cover ransomware attacks?

Ransomware is widespread. Make sure that payments, downtime and recovery costs are covered where necessary. In the worst case, this makes a substantial difference to your company's liquidity after an incident.

Can your cyber insurance be reviewed and adjusted?

Clarify whether you can adjust your policy in response to new threats or other changes, so that you stay properly covered.

How long do you have to report an incident?

Insurers usually want to be informed relatively early. However, it is to your advantage if you can focus on recovery first.

When and how is a claim paid out, and is there an excess?

Insurers usually offer different levels of cover. From direct payment of all costs incurred and forensics to limiting reputational damage, there are many models to choose from. Clarify exactly what applies and choose a policy that fits your situation.