To answer an insurer's security questionnaire well, prepare evidence for the four areas that regulation pushes insurers to ask about: access controls including multi factor authentication, encryption in transit and at rest, breach notification terms, and representations about your security policies. New York's 23 NYCRR 500.11 shows the pattern.
Why do insurers send long questionnaires?
Regulators expect insurers to oversee their vendors. In New York, the Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500, covers licensed financial entities including insurers. Section 500.11 requires each covered entity to have written policies and procedures to secure information systems and nonpublic information that third party service providers can access or hold.
The section says those policies must be based on the entity's risk assessment and address, as applicable: identifying and assessing third party providers, minimum cybersecurity practices providers must meet to do business, due diligence on those practices, and periodic reassessment based on risk. The questionnaire is the due diligence step. Other states and countries have similar rules, and this post draws only on the New York text we fetched, as an example. Check which laws bind your customer.
What do they want to see?
Section 500.11(b) lists guidelines that due diligence or contracts should address to the extent applicable:
- The provider's policies and procedures for access controls, including multi factor authentication, to limit access to relevant systems and nonpublic information.
- The provider's use of encryption to protect nonpublic information in transit and at rest.
- Notice to the covered entity in the event of a cybersecurity event directly affecting the entity's systems or nonpublic information held by the provider.
- Representations and warranties about the provider's cybersecurity policies and procedures relating to the entity's systems or data.
Almost every question in a long form maps to one of these four, or to the risk assessment behind them.
How do you prepare answers?
Build a standing answer pack rather than answering each form from scratch.
Access. A one page description of how staff reach production: single sign on, MFA enforced, role based access, quarterly access reviews, and how leavers are removed. Attach a recent review record.
Encryption. The protocols and ciphers for data in transit, the storage encryption for data at rest, and how keys are managed and rotated. State what is not encrypted, if anything, and why. Honest gaps with a plan read better than vague claims.
Incident notice. The time commitment you can actually keep, who sends it, to which contact, and what it contains. Rehearse it. A promise of notice within a set number of hours is a contract term, so your incident runbook must support it.
Warranties. Counsel should review every representation. Answer with what is true today and documented. Do not describe a certification as complete if it is in progress.
A constructed example
An insurer asks, "Do you encrypt nonpublic information at rest?" A weak answer: "Yes." A strong answer: "Customer data in our primary database and object storage is encrypted at rest using provider managed keys, with keys rotated on a schedule. Backups are encrypted. Application logs are scrubbed of policyholder identifiers before storage. Evidence: encryption configuration export dated this quarter, available under NDA."
What to do
- Identify which regulations your insurer customers are under, and ask for their requirements.
- Create a standard answer pack covering access, encryption, incident notice and warranties.
- Attach dated evidence: access review, encryption config, incident runbook, test results.
- Keep a log of every answer you give so the next form stays consistent.
- Have legal review contract representations before you sign.
- Review the pack each quarter and after any major system change.
- Expect periodic reassessment, and keep evidence fresh enough to survive it.
Safeguard's compliance automation can help assemble evidence like access reviews and vulnerability management records. It does not make you compliant with any insurer's or regulator's requirements.
Quick check
Does 500.11 apply to my vendor company directly?
It binds the covered entity, such as a licensed insurer. It reaches you through due diligence and contract terms the entity must apply.
Should I answer yes to everything?
No. Answer what is true and documented. Representations can become contract warranties.
Sources
- 23 NYCRR 500.11 Third-party service provider security policy, Cornell Legal Information Institute, fetched 18 October 2026
- Cybersecurity Resource Center, New York DFS, fetched 18 October 2026
Last reviewed: 18 October 2026.
