How to Handle Cyber Liability Insurance Application Questions

Most businesses now understand that cybersecurity insurance exists and is important to have, but many don’t know what exactly goes into a cyber liability insurance application. Providers will ask plenty of questions about your existing security infrastructure in order to get a better understanding of how vulnerable you are and how much risk of being breached you have.

Is your business prepared for the cyber liability insurance application process? Use our checklist, How Covered is Your Business?, to help determine what cybersecurity tools you need to build an effective security system.

The Importance of Cyber Liability Insurance

Cybersecurity liability insurance is an insurance policy that covers damages related to cybersecurity where information/data is compromised. This type of policy protects businesses if a third party sues the business for damages caused by the cyberattack, like any financial loss due to lack of service, lost data, and more.

Aside from protecting policyholders against lawsuits, cyber liability insurance also can pay for attorney fees (and other fees associated with legal proceedings), settlements, and fines due to non-compliance.

Why businesses need cyber liability insurance is simple: it protects you from the financial harm associated with a cyber incident and its damage to your customers and other third parties. When attacks occur and damage is inflicted, your business might be liable to cover those damages but insurance policies like this can lighten the blow.

Questions to Expect During a Cyber Liability Insurance Application

Part of the application process for cyber liability insurance is answering many questions about your current cybersecurity standing. Questions range from all things cyber, including data security, backing up information, compliance questions, training, and access controls.

These questions are designed to reveal how vulnerable you are to attack so that insurance companies can decide the details of your policy, including how much they’re comfortable covering and how much they’ll charge you every month or year. Businesses found to be lacking in most areas of security will, most often, be charged more or even denied coverage.

Other factors that insurance providers look at when determining your policy include:

• Amount of data stored and general sensitivity of it
• Business size
• Industry
• Annual revenue

To help you prepare for this assessment, we’ve compiled some of the most common questions asked by insurance companies below, along with what you need in order to answer effectively and satisfy the requirements.

Data Backups

Part of protecting data is having backups ready to be used in the event of a breach. These backups can limit the damage to third parties post-breach by getting things up and running again quickly.

Example Cyber Liability Insurance Application Questions:

• Do you perform regular data backups?
• Do you store backups off-site or on-location? If off-site, where?
• How often do you backup data?

Compliance and Special Data

Depending on what types of data you store, who you work with/sell to, and what industry you work in, you might be required to maintain compliance with certain regulations. If your business is not compliant, this can expose you to more damages when a breach occurs.

Example Cyber Liability Insurance Application Question:

• How many PII records are stored in your network?
• How often do you audit your compliance requirements?
• Who assesses your compliance?

Security Training and Education

Related Blog: The Importance of Cybersecurity Awareness Training and Education

The human element of cybersecurity is one of the most important. Cybercriminals are always looking for ways to trick your employees into giving up key information that can be stolen and used against your business. Providers want to know how educated your teams are in security best practices and how often you update them on key trends and details.

Example Cyber Liability Insurance Application Questions:

• Do you provide periodic security training for employees? How often and what content?
• What types of training do you provide to your teams?
• Do you require cybersecurity training?

Assessments and Security Audits

Cybersecurity is not a ‘set it and forget it’ aspect of business. It’s always evolving and changing as cybercriminals find new ways to get into your network. To counter this, companies need to regularly perform security assessments and audits of their system to find new vulnerabilities and introduce more solutions to secure them.

Example Cyber Liability Insurance Application Question:

• How often do you conduct phishing assessments?
• How often do you audit your entire security system?
• Who is assessing the effectiveness of your security?

Access Control

One of the ways that cybercriminals get access to data is by stealing credentials and using them to get into your system. Controlling who has access to what can limit this damage and lower your vulnerability to data breaches.

Related Blog: 5 Identity and Access Management Best Practices

Example Cyber Liability Insurance Application Questions:

• Do you limit remote access to all computer systems and utilize multi-factor authentication (MFA)?
• What do you do to protect privileged accounts?
• If using Office 365, are you using MFA? Advanced threat detection?
• Can users access email and other communications through non-business devices?
• How do you decide who has administrative rights and privileges?

Data Security

One of the most important parts of a liability insurance application, providers need to know how capable your business is of protecting data.

Example Cyber Liability Insurance Application Questions:

• Do you encrypt data when it’s being shared and stored?
• How long does it take you to install critical patches?
• Do you have a SOC monitoring your system logs?
• Do you vet your third-party vendors for security?
• What steps are you taking to detect and prevent ransomware?
• How segmented is your network?
• Do you have password management software?
• How do you retire and replace out-of-support hardware/software? Are they segregated from the rest of your network?
• Do you use endpoint protection?

What Can Businesses Do to Lower Premiums and Improve Their Application?

The costs of cybersecurity insurance are steadily rising. This is not a surprise since the demand for coverage has also grown considerably since 2020 and the pandemic which saw a huge spike in cyberattacks.

In 2021, the average cost of cybersecurity insurance was $1,589 per year, up more than $100 from 2020. In 2022, premiums are rising around 25% with some policyholders paying up to 80% more. These costs also rise when your business is deemed to be vulnerable to threats due to a lack of security.

This is why it’s so important for businesses to have strong cybersecurity before applying for insurance. When businesses have a stronger security posture already in place before applying, they’re not only more secure, but they also put themselves in a position to lower their monthly premium and improve their overall coverage.

To lower premiums, and successfully answer the questions above, businesses need to acquire what’s necessary to build a good cybersecurity posture. This can be done in a couple of different ways, including:

• Building an in-house security strategy using your own people (whether they be existing IT teams or new cybersecurity hires).
• Partnering with a managed security services provider (MSSP) to get what you need.

How an MSSP Helps

With an MSSP, like DOT Security, your business can get everything it needs to implement proper security systems without having to carry as much of the load (hiring, buying technology, building facilities, etc.). With an MSSP partner, you get access to a team of security experts (analysts, engineers, vCISOs, and more), the best technology, 24/7 monitoring, and a slew of other services designed to keep you secure.

In Conclusion

Insurance providers want to know that you have a solid security strategy in place before covering you, because whether you have existing security measures in place impacts your ability to be covered, your premiums, and how much coverage you’ll get.

Having a solid cybersecurity foundation is a key part in obtaining good cyber liability insurance that doesn't break the bank and which protects you from damages due to breaches and cyberattacks.

Is your business ready to apply for cyber liability insurance? Use this checklist—How Covered is Your Business?—to help determine what security measures you need to have a modern, layered security strategy.