The cyber insurance market has changed dramatically in recent years. Ransomware, data breaches and email fraud have multiplied claims, forcing insurers to tighten their eligibility criteria.
What insurers are asking now
Before granting you coverage, a cyber insurer will typically verify:
Authentication and access
- Is multi-factor authentication (MFA) enabled on your email, VPN and critical systems?
- Are administrative privileges limited to those who absolutely need them?
- Are former employee accounts disabled promptly?
Backups
- Do you have regular backups, offline or in an isolated environment?
- Do you test backup restoration?
- Would your backups be accessible in the event of a ransomware attack?
Workstation protection
- Are you using an endpoint detection and response (EDR) tool rather than a simple antivirus?
- Do your workstations receive security updates promptly?
Training and awareness
- Have your employees received phishing training?
- Have you conducted phishing simulations?
Consequences of an inaccurate questionnaire
Answering a cyber insurance questionnaire inaccurately can have serious consequences. If you declare that MFA is in place and it was not at the time of an incident, the insurer may refuse to pay the claim — even if you have been paying your premiums for years.
How Pilote TI can help
We prepare your systems to meet the requirements of cyber insurers. Before your renewal or first subscription, we can:
- Audit your current measures against insurability criteria
- Implement missing controls (MFA, EDR, patch management)
- Document your measures to facilitate questionnaire completion
Obtaining good cyber coverage at a reasonable price is now directly linked to the maturity of your IT practices. It is a virtuous circle: better practices, less risk, better premiums.