Cyber insurance checklist: what your insurer will ask

Last updated: 27 October 2026 · IT-Checklist editorial team

When you take out cyber insurance, the insurer asks about your security. Do you use MFA? How do you make backups? Do you have antivirus and a firewall? The exact questions differ per insurer. Your answers decide whether you are accepted and what you pay.

This checklist puts it all in one place: your policy, what it covers, which measures you have and where the proof is. It also says what to do when things go wrong. Fill it in, print it and keep it with your emergency plan. Below the checklist you find the IT checklist topic where you arrange each measure.

What you type in the fields appears on the print. We don't store it anywhere, so print or save the PDF before you close the page.

Rather fill it in on your computer? Download the blank PDF with form fields, fill it in with a PDF reader such as Adobe Acrobat Reader and save it.

2. What does your policy cover?

Cyber insurance has no fixed content. Tick what your policy covers. If something is missing, check whether another policy covers it, or decide to carry that risk yourself.

Repair or replacement of hardware and software
Restoring data and rebuilding your records
Hiring specialists, such as an incident response firm or forensic investigation
Lost revenue while you are down
Claims from customers or others who were affected
Legal help with a data breach under the GDPR
Help with communication and reputational damage
An emergency line you can call day and night
Staff training

3. Measures insurers ask about

These questions often appear on an application form. Your own insurer may ask more or different ones; you find them in the form and the policy terms. For each measure, write down whether it is in place and where the proof is, such as a screenshot or a report. That helps with the application and later with a claim.

Measure	In place? (yes/no/partly)	Proof and where it is
MFA on email, remote access and admin accounts
Backups separate from the network, and a tested restore
Timely updates, including website and router
Antivirus or EDR on every device
Firewall and a secured network
Separate admin accounts, only for those who need them
Phishing training for staff
Emergency plan and incident response team
Risk scan or certification (e.g. ISO 27001)

4. In an incident

Read your policy now to see what is expected of you. Some insurers want you to call their emergency line first or use their own incident firm. If you don't, that can affect your payout.

We know whether we must call the insurer's emergency line first
We know whether we may hire our own IT or incident response firm
The emergency number is in the emergency plan and on paper
We consult the insurer before we make costs we want to claim
We write down what happens, with times, and keep evidence for the claim
We know the deadline for reporting a claim

5. Don't keep your policy where a hacker looks

Dutch police research among small businesses found that insured companies paid 2.8 times more ransom on average. After breaking in, criminals search for words like 'policy' and 'insurance' and set their demand to match the cover.

The policy is not on the shared drive or in a folder everyone can open
There is a paper copy or a copy outside the company network
Only those who need to know the sum insured know it

6. Do you need cyber insurance?

No policy yet? Answer these questions first. Cyber insurance is mainly meant for damage that is rare but large.

Which damage do you want to insure, and why? (e.g. days of downtime, customer claims)Do your existing policies already cover damage caused by digital systems? Check the terms.Can you carry that damage yourself, or do you not want to?Do customers or clients ask for cyber insurance?

Cyber insurance checklist: what your insurer will ask

1. Your policy

2. What does your policy cover?

3. Measures insurers ask about

4. In an incident

5. Don't keep your policy where a hacker looks

6. Do you need cyber insurance?

Arrange the measures in the IT checklist

Sources