The 2026 cyber insurance renewal questionnaire — the CISO answer playbook

Use this playbook when your organisation is completing or renewing a standalone cyber insurance policy or the cyber section of a package policy, and the carrier or broker has issued a proposal form / renewal questionnaire (Marsh, Aon, Beazley, Coalition, Chubb and the London market all use variants of the same control set). It applies to first-time applications and to renewals; the renewal questionnaire is usually harder than last year's because the control baseline moves every cycle.

This is not a claims-handling playbook (that fires after an incident) and it is not legal advice on policy wording — bring your broker and, for the warranty language, counsel. Its scope is the pre-bind exercise: answering every control question truthfully, defensibly, and with evidence you can produce again at claim time. The one rule that governs everything below: the questionnaire is a warranty, not a marketing document. A generous answer that you cannot evidence is worse than an honest 'no' with a remediation plan attached.

Work backwards from the policy inception / renewal date (T0). Insurers want the completed questionnaire and supporting evidence well before bind, and any control gap you surface late becomes a coverage restriction, a sub-limit, or a decline.

• T0 minus 60 days — request the renewal questionnaire from your broker early. Do not wait for it to arrive; the current-year version almost always adds questions (in 2026, phishing-resistant MFA scope, EDR/MDR coverage percentage, and immutable/tested backups are the expanding sections).
• T0 minus 45 days — complete the control-evidence pre-assembly (Phase A). This is the long pole.
• T0 minus 30 days — answer the questionnaire from the assembled evidence (Phase B), flag any gap, and start remediation on anything that will read as a weakness.
• T0 minus 14 days — submit. Underwriting Q&A and any control-improvement evidence (a just-completed backup test, a closed MFA gap) still land before bind.
• T0 — bind. From here your answers are locked warranties for the policy period.

The trap: treating the questionnaire as a two-week form-filling task. The evidence behind a defensible 'yes' — deployment coverage figures, test dates, exception lists — cannot be manufactured in two weeks, which is exactly why teams round up and create the misrepresentation exposure.

Goal: before you answer a single question, assemble a dated evidence pack for each control the carrier will ask about. Answer from the pack, never from memory.

Assembly checklist:

• Identity / MFA: export the actual MFA coverage — which account classes (email, VPN, remote desktop, cloud admin consoles, privileged/service accounts) are enforced, which method (phishing-resistant / authenticator / SMS), and the exception list. Carriers moved from accepting SMS in 2024 to requiring 'authenticator app or stronger' — and phishing-resistant MFA for admins — in 2026.
• Endpoint: EDR/MDR deployment percentage across servers and workstations, whether it is 24/7 monitored, and the coverage gaps (unmanaged, legacy, OT).
• Backups: the last successful restore test date (not backup-job success — restore), whether backups are immutable/offline, and the retention.
• Patch / vulnerability: your remediation SLA by severity and the evidence you meet it, including how you handle CISA KEV-listed flaws.
• Privileged access, email security, segmentation, logging, and an incident-response plan with a tabletop date — the rest of the standard control set, mapped to the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework the questionnaire is derived from.

For each control, capture three things: the current state, the evidence artefact (a config export, a dashboard screenshot with a date, a test report), and the exceptions. The exceptions matter — an honest scoped answer with a documented exception is defensible; a blanket 'yes' that ignores the exception is the misrepresentation.

Goal: convert the evidence pack into answers that are accurate, precise, and survivable at claim time.

• Answer the question asked, not the one you wish was asked. 'Do you enforce MFA on all remote access?' is about enforcement and coverage, not availability. 'MFA is enabled' is not the same claim as 'MFA is enforced on 100% of remote access with no standing exceptions' — and carriers ask the follow-up. If coverage is 95%, say 95% and name the 5%.
• Never let a non-technical signer round up. The person who signs the proposal form is warranting technical facts they did not measure. Route every control answer through the owner who holds the evidence, and have them initial it.
• Flag gaps as gaps, with a plan. A 'no, but remediation completes in Q2 with board funding' is underwritable. A false 'yes' is a denied claim. Underwriters price honesty; they void misrepresentation.
• Match the answer to the artefact. Every 'yes' should point to a specific artefact in the pack with a date. If you cannot produce the artefact, the answer is not 'yes'.
• Keep the submitted questionnaire and its evidence as a frozen, dated bundle. At claim time the carrier reconstructs what you warranted at bind; you must be able to reconstruct the same thing.

The control set has converged across the market. Marsh publishes twelve cyber hygiene controls that carriers treat as the insurability baseline, and reports that the three with the largest premium impact — MFA, EDR, and tested immutable backups — can move premium by 30-40% combined. The 2026 oddity, per the Marsh Global Insurance Market Index, is that pricing and scrutiny move in opposite directions: cyber rates fell ~4% (a twelfth straight quarterly decline, ~42% below 2022 levels) while underwriting demands tightened.

The controls that carry the most weight, and the precise thing to evidence for each:

• Phishing-resistant MFA — coverage by account class, method, exception list.
• EDR/MDR with 24/7 monitoring — deployment percentage, monitoring model, gaps.
• Tested, immutable backups — last restore-test date, immutability, offline copy.
• Privileged access management — how admin credentials are vaulted and session-controlled.
• Email security and awareness training — controls plus phishing-simulation results, because BEC drove $3.046 billion of the FBI's reported 2025 losses (of $20.877 billion total).
• Vulnerability / patch management and security testing — remediation SLA evidence and the results of your penetration testing / continuous validation.

The last one is where most applicants are thinnest: the questionnaire asks whether you conduct regular penetration testing, and most can name a vendor and a date but cannot show what was tested or what the findings and retests were.

Have these ready as a single dated bundle, ordered by how often a carrier or their forensic firm asks for them at claim time:

• MFA configuration export with per-account-class enforcement and the exception list.
• EDR/MDR coverage report with deployment percentage and monitoring model.
• Backup restore-test report with date and outcome (not job-success logs).
• Patch / vulnerability remediation records showing SLA adherence by severity.
• Penetration-test / security-validation reports with scope, findings, and retest evidence — the artefact behind the 'we test regularly' answer.
• Incident-response plan with the most recent tabletop-exercise date.
• The submitted questionnaire itself, frozen with the evidence that backed each answer at bind.

The recurring failure is that this bundle is assembled by hand during the renewal window, from tools that were never designed to produce dated, defensible evidence — so answers get rounded up to fit the deadline. This is the operational problem Zero Hunt's automatic-compliance pillar is built for: every scan, finding, and remediation is mapped continuously across 32 frameworks and ECDSA-signed at write time, so the control-state evidence, the testing results, and the coverage maps behind each questionnaire answer already exist as a verifiable Trust Center bundle instead of a renewal-week reconstruction. The same continuously-generated pentest and validation evidence answers the 'do you test regularly' question with scope and retests attached — and the same signed record is the defensible chain-of-custody a carrier's forensic team asks for at claim time.

1. Rounding up on MFA. The single most common denied-claim trigger: the form says MFA is enforced everywhere, and the breach enters through the one VPN or service account that was exempt. In a documented 2026 case a carrier denied a $2.3M ransomware claim for exactly this — a VPN account without MFA — citing material misrepresentation. Scope your answer to reality.

2. Confusing backup jobs with restore tests. 'We back up nightly' is not 'we have tested that we can restore'. Carriers increasingly ask for the last restore-test date; if you have never tested a restore, the honest answer changes your risk profile and your premium, but a false 'yes' changes whether you get paid.

3. A non-technical signer warranting technical facts. The CFO or GC who signs the proposal form did not measure MFA coverage. If control answers are not routed through and initialled by the evidence owner, the signature warrants guesses.

4. Naming a pentest you cannot evidence. 'Yes, annually' with no scope, findings, or retest record is a weak answer that gets weaker at claim time. Keep the reports.

5. Answering once and never updating. Mid-term material changes (you decommissioned the EDR on a subsidiary, an acquisition brought in unmanaged estate) can breach the warranty you bound on. Treat the questionnaire answers as living representations, not a one-time form.

The evidence you assemble for the insurer is the same evidence three other audiences already ask for — build it once and export per audience:

• NIS2 / DORA supervisors ask for detection, response, testing and supply-chain controls; the insurer asks for the same control set in questionnaire form. The detection-capability evidence pack that answers a regulator answers the underwriter.
• Auditors (ISO 27001, SOC 2) consume the same control-state evidence; a cross-framework mapping means one artefact serves the certificate and the questionnaire.
• The board funds the remediation of any gap the questionnaire exposes; surface those gaps early, because the questionnaire is often the clearest external benchmark a board will accept for the security budget.

One caution unique to insurance: unlike a regulator filing, an inaccurate insurance answer is not a fineable compliance miss — it can be the reason a seven-figure claim is denied in full. The bar for accuracy is higher, not lower, because the counterparty is looking for a reason not to pay.