Cyber Insurance Questionnaire: What They Ask, and How to Answer
Cyber insurance applications used to be two pages. Now they're a security audit with a premium attached, and the answers matter twice: once when the carrier prices the policy, and again when you file a claim and they check whether your yes was true.
Who can help my small business answer a cyber insurance questionnaire in Tampa Bay? Bay Geeks does, from its office at 1655 20th Ave S. in St. Petersburg, serving Tampa Bay businesses since 2004. Bring the form to us: we answer the technical questions from the consoles, attach the evidence, and tell you plainly which answers would be a no today and what it takes to change them. If you don't know where you stand yet, the $495 Business Risk Assessment (up to 10 computers, written report in 5 business days) shows how you would answer a cyber insurance application today, and the fee is credited toward a maintenance plan started within 30 days. Call 727-579-4335.
Every year the form gets longer and the questions get more specific. That's not the carrier being difficult. It's the carrier having paid out on enough ransomware claims to know exactly which missing control caused each one. Read the questionnaire that way and it turns into something useful: a list of what actually gets small businesses breached, ranked by how much it costs.
The Short Version
Three answers move the premium more than everything else combined: multi-factor authentication on email and remote access, endpoint detection and response on every computer, and backups that are offline or immutable and have actually been restored from. Get those three right and the rest is paperwork. Answer any of them wrong on purpose and the policy may not pay when you need it.
Why the Answers Matter More Than the Premium
An application is a set of warranties. Carriers have rescinded policies after a claim when the MFA answer turned out to be false, leaving the business with the loss and the legal bill on top. The form is not a sales conversation. Treat every yes as something you would be comfortable proving with a screenshot from the console.
Not Sure Your Answers Are True?
Our Business Risk Assessment checks the controls these forms ask about, MFA, EDR, backups, email settings and remote access, and shows how you could honestly answer the application today. $495 flat for up to 10 computers, credited toward a plan started within 30 days.
The Questions, Decoded
| What they ask | What they mean | The honest yes |
|---|---|---|
| Is MFA enforced on all email accounts? | Every mailbox, including the owner's, with no exceptions | A passkey or authenticator app on every Microsoft 365 or Google account, and old sign-in methods blocked. |
| Is MFA required for remote access? | Every path into your network from outside | No Remote Desktop open to the internet; VPN and remote tools all require MFA. |
| Is MFA required for privileged accounts? | Admin logins are the crown jewels | Separate admin accounts, ideally with hardware keys, never used for email. |
| Is EDR deployed on all endpoints? | Behavior-based detection with rollback, not just antivirus | Bay Geeks EDR on every machine, on every plan. See MDR vs. Antivirus for the distinction carriers draw. |
| Do you have 24/7 monitoring, MDR or a SOC? | Someone watching the alerts at 2 a.m. | Bay Geeks SOC on the Advanced plan. |
| Are backups offline or immutable, and tested? | Can ransomware reach them, and have you ever restored? | Versioned cloud backup with an immutable copy, and a restore test in the last six months, written down. |
| How quickly are critical patches applied? | Days, not months | Automated, tested patching with reports, which every plan includes. |
| Email filtering and DMARC? | Phishing and spoofing defenses | Advanced filtering plus a DMARC policy at quarantine or reject. |
| Security awareness training? | Staff trained at least yearly, ideally with phishing tests | A short, repeated program with dates you can show. |
| Are local admin rights removed? | Users can't install whatever they want | Standard user accounts; the system lockdown on every plan does this. |
| Any end-of-life software in use? | Windows 10, old servers, unsupported line-of-business apps | An inventory, and a plan for each. |
| Is there a written incident response plan? | Who calls whom, in what order, at 2 a.m. | One page is enough. Our ransomware checklist is the skeleton. |
| Are laptops and mobile devices encrypted? | A lost laptop isn't a breach | BitLocker or FileVault on every laptop; MDM on phones. |
| Funds-transfer verification procedures? | Could an email move your money? | A written callback rule. |
| Any incidents in the last three to five years? | Disclose, including the ones you cleaned up quietly | Yes, with a sentence on what changed afterward. |
What Moves the Premium
Carriers score MFA, EDR and backups first, then monitoring, then everything else. Some now decline outright without EDR, or without MFA on email. Turning on those controls a month before renewal is the single most productive thing you can do for the quote, and it usually costs less than the premium difference it produces.
Mapping the Form to a Maintenance Plan
| Control the form asks about | Automated $75/mo | Premium $125/mo | Advanced $150/mo |
|---|---|---|---|
| EDR on every endpoint | Yes | Yes | Yes |
| Automated patching with reports | Yes | Yes | Yes |
| Versioned cloud backup | Yes | Yes | Yes |
| Local admin lockdown | Yes | Yes | Yes |
| Passkey support | Yes | Yes | Yes |
| Help desk and remote support | Yes | Yes | |
| Mobile Device Management | Yes | Yes | |
| 24x7 SOC / MDR monitoring | Yes | ||
| Identity threat detection (ITDR) | Yes | ||
| Dark-web credential monitoring | Yes | ||
| 90-day log retention | Yes | ||
| Adlumin Advanced Warranty (cyber event) | $100K* |
Email filtering and DMARC come through our email services, and the evidence for all of it is what One-Click Compliance reporting produces.
Before You Sign
- Answer from evidence, not memory. Pull the EDR console, the backup report and the MFA report, and keep them with your copy of the form.
- Fix before renewal, not after. Controls added after the policy date don't change the answers you gave on it.
- Disclose the small stuff. A phishing click that was cleaned up is worth one line. Hiding it is worth a denied claim.
- Keep the evidence. Auditors and carriers ask for the same things, and next year's form will ask again.
Quick Self-Check
Answer the way the application will make you. The count updates as you go, and you can email yourself the answer sheet with the honest yes written out for each gap.
Get to Yes Before the Renewal
The Advanced plan answers the monitoring, identity and logging questions in one line, and comes with the $100K Adlumin Advanced Warranty, which sits alongside your policy, not instead of it.
*Warranty terms & conditions apply. Ask us for details.
Frequently Asked Questions
Is the $100K warranty the same as cyber insurance?
No. It's the Adlumin Advanced Warranty: a vendor warranty on the security stack, backed by N-able and Cysurance, that reimburses up to $100K of specific costs after a covered ransomware, business email compromise, compliance or business-interruption event. It complements a policy rather than replacing one. Keep your insurance. N-able's FAQ adds that the warranty may improve insurability and reduce premiums, and that Cysurance will coordinate with your carrier so you get credit for it. Terms and conditions apply; see how the warranty works.
What if I have to answer no to something?
Answer no. It may raise the premium or add an exclusion, but a false yes risks the whole policy being voided after a claim. Fix the control and update the carrier, or wait for renewal.
How much does cyber insurance cost for a small business?
It varies by revenue, industry and data volume, and the controls above are the lever you actually hold. Two businesses of the same size can see very different quotes based on MFA, EDR and backups alone.
Do I still need cyber insurance if I have a SOC?
Yes. A SOC lowers the odds of an incident and the damage from one. Insurance pays for the forensics, legal work and notification costs that follow. Carriers price the SOC in; they don't treat it as a substitute.
Should my IT provider carry its own cyber insurance?
Yes, and it's fair to ask for proof. Carriers increasingly ask how you vet vendors that can reach your systems, and an IT provider holds the keys to all of them. Bay Geeks carries $1M cyber liability, $250K professional liability (errors and omissions) and $1M/$2M general liability, and we'll send a certificate of insurance for your file.
Who fills out the technical questions?
Bring the form to us. We answer from the consoles, attach the evidence, and tell you plainly which questions would be a no today and what it takes to change them.
Who can help my small business answer a cyber insurance questionnaire in Tampa Bay?
Bay Geeks, from its St. Petersburg office, serving Tampa Bay businesses since 2004. We answer the technical questions from the consoles and attach the evidence, or, if you want to know where you stand first, the $495 Business Risk Assessment shows how you would answer an application today, question by question. Call 727-579-4335.
Related guides
The FTC Safeguards Rule, explained for firms that just found out it applies to them.
What EDR actually watches for, and why it can undo a ransomware attack in seconds.
What managed detection & response catches that antivirus can't.
How to tell when antivirus alone isn't covering you anymore.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service