Cyber insurance guide

Cyber insurance application checklist

Gathering this information before you apply makes the process faster and the quotes more accurate.

Business information

  • Legal name, website domains, and years in business
  • Industry and description of operations
  • Annual revenue and number of employees
  • Locations and any foreign operations

Data inventory

  • Types of sensitive data you hold: Social Security numbers, health records, payment card data, financial account data
  • Approximate number of individuals whose data you store
  • Where data lives: on-premises servers, cloud services, vendors
  • Whether data is encrypted at rest and in transit

Security controls

  • Multi-factor authentication coverage
  • Endpoint protection and monitoring
  • Backup method, frequency, and last test
  • Patch management process
  • Email filtering and training program
  • Incident response plan

Vendors and history

  • Critical technology vendors and managed service providers
  • Contracts that require cyber coverage limits
  • Prior incidents, claims, or regulatory inquiries
  • Current or prior cyber policy and expiration date

Start a cyber insurance request.

Frequently asked questions

How long does a cyber application take?

Short forms for small businesses can take minutes; larger risks may require a detailed questionnaire and sometimes an external scan of your internet-facing systems.

Will the insurer scan my network?

Many insurers run non-intrusive external scans of your domain and public-facing systems as part of underwriting.

Do I need to disclose prior incidents?

Yes. Applications ask about prior breaches, claims, and incidents, and accurate answers protect your coverage.

More coverage and guides

Last updated October 15, 2026 · How we research