The UK National Cyber Security Centre's cyber insurance guidance says plainly that "if you're claiming that security measures are in place when they're not, the insurer may not be obliged to pay any claims." It adds that most policies are reassessed every 12 months. Verizon's 2026 Data Breach Investigations Report, covering 1 November 2024 to 31 October 2025, found vulnerability exploitation had overtaken stolen passwords as the top way in, at 31 percent of breaches.
Put those together and the application becomes a document you may have to defend after an incident. Treat each answer as a statement you must be able to prove.
What's affected
Software companies buying or renewing cyber cover, or answering an enterprise customer's insurance clause. Applications ask about controls. The NCSC notes that buying a policy "might require providing information about your security controls", and that gathering this can involve staff and outsourced IT providers.
How to check if you're exposed
For every control question, fill in a table like this before you sign:
| Application question | Your answer | Proof | Last verified |
|---|---|---|---|
| MFA on email and admin accounts | Yes | Identity provider policy export | date |
| Backups tested | Yes | Restore test record | date |
| Patching process | Yes | Scan report and ticket history | date |
| Incident response plan | Yes | Plan document and last exercise note | date |
| Staff security training | Yes | Completion report | date |
Any row with no proof is a risk to correct before you answer Yes.
What to do now
- Get the application early and have the person who runs the systems answer it, not only the person who signs.
- Fill in the proof table above. Change answers you cannot support.
- Read the exclusions as carefully as the coverage. The NCSC says to understand what is excluded, and gives business email compromise fraud as an example of a loss some policies leave out.
- Do not stop at the insurer's minimum. The NCSC advises against aiming only for stated minimums, which may not protect what matters most to you.
- Set a calendar reminder for the 12 month reassessment and tell the insurer about material changes.
- Keep the proof table with the policy.
A practical point on ownership: the person who signs the application is rarely the person who knows whether MFA covers every admin console. Put the engineer and the signer in the same short meeting, walk the table row by row, and record who confirmed each proof. If a claim ever has to be defended, that record shows the answers were checked.
How to avoid this trap
- Do not answer from memory. Check the identity provider and backup logs.
- Do not let a control lapse after you answer. A policy that says MFA is enforced must stay true all year.
- Do not tick Yes for "mostly". Say partial, and describe it.
Try it yourself
Take the five rows above and gather proof for each in under an hour. The ones that take longest are the ones to automate.
Click through it at your own pace, or open it full screen.
Quick check
Why can a wrong application answer cost you a claim?
If you claim controls are in place when they are not, the insurer may not be obliged to pay, according to the NCSC.
How often are most cyber policies reassessed?
Every 12 months, per the NCSC guidance.
