Every year, the renewal lands in your inbox: a cyber insurance questionnaire with dozens of questions about MFA, backups, patching and "privileged access." Someone has to tick yes or no, and an officer of the company has to sign it. In many small businesses, that someone is the owner or office manager, working from memory and a quick email to the IT provider.
That signature matters more than most people realize. Your answers become part of the basis on which the insurer accepts your risk. If an answer turns out to be wrong after an incident, the claim you were counting on can shrink or disappear.
This guide is for owners, office managers and finance leads at Canadian businesses with roughly 5 to 200 staff. It explains what the common questions really mean, where businesses most often answer them wrongly, and a step-by-step way to complete your next application accurately.
Key Takeaways
- Treat the questionnaire as a signed statement of fact about your environment. In the Travelers v. ICS case, a single wrong answer about MFA led to the policy being rescinded after a ransomware attack.
- Coverage can fail in two ways: a misstatement on the application, or a policy condition or exclusion that applies. Hamilton's insurer denied its ransomware claim under an exclusion for losses where missing MFA was the root cause (reported July 2025).
- "Yes" to MFA usually means every remote access path, every email account and every admin account, not just the firewall or Microsoft 365.
- Collect evidence before you answer: screenshots, reports and a named owner for each control. Ask your IT provider to confirm answers in writing.
- If the honest answer is "no," say so and attach a dated plan. A gap you disclosed can be priced or fixed. A gap you hid can cost you the whole claim.
Why your cyber insurance questionnaire answers decide whether a claim gets paid
The application is not paperwork you file and forget. Insurers price and accept your policy based on what you tell them. Many applications end with a declaration that the answers are true and complete, signed by a senior officer.
The best-known example is Travelers v. International Control Services (ICS). ICS, a US electronics manufacturer, stated on its application that it used multi-factor authentication (MFA) to protect access to its systems. After a ransomware attack in 2022, the investigation found MFA was only protecting the firewall, not the servers and other systems behind it. Travelers asked a court to rescind the policy, and on August 26, 2022, the court entered a judgment rescinding it (Lockton, September 2022). Rescission means the policy is treated as if it never existed. ICS is a US case. In Canada, how a misstatement is treated depends on provincial insurance law and your policy wording, but the lesson is the same: answer accurately.
Canada has its own warning. The City of Hamilton was hit by ransomware on February 25, 2024, through an internet-facing server, and about 80% of its network was disabled. Its insurer denied the claim. The policy excluded losses where the absence of MFA was the root cause, and MFA had not been fully implemented. The insurer had asked for MFA in late 2022. City taxpayers are now covering the full $18.3 million recovery bill (Global News, July 31, 2025).
Hamilton is a city, not a small business, but the lesson carries over. Your coverage depends on two things: what you told the insurer on the application, and the conditions and exclusions written into the policy. Both point back to the same controls. If you're also weighing whether your coverage is worth it at all, our article on the new realities of cyber insurance in 2026 covers the market side.
What does the cyber insurance questionnaire actually ask?
Most questionnaires cover the same ground, even when the wording changes between insurers. Marsh, one of the largest insurance brokers, groups the controls insurers look for into 12 areas. It notes that insurers are "asking more questions than ever before about an applicant's cyber operating environment and risk controls" (Marsh Canada, Twelve key controls). The Government of Canada's Get Cyber Safe program adds that insurers also ask what confidential data you hold, when your last security audit was and whether you acted on its recommendations (Get Cyber Safe, October 2022).
The table below translates the most common questions into plain language, with the evidence to keep on file.
| Question (typical wording) | What "yes" usually means | Evidence to keep |
|---|---|---|
| Do you require MFA for remote access? | Every way into your network from outside: VPN, remote desktop, remote support tools and cloud admin portals | VPN and remote tool settings showing MFA enforced; list of remote access methods |
| Do you require MFA for email? | Every mailbox, including shared, service and former-employee accounts that still sign in | Microsoft 365 or Google Workspace report of MFA status for all users |
| Is MFA required for privileged or admin accounts? | Domain admins, Microsoft 365 global admins, backup consoles, firewalls and your IT provider's accounts | List of admin accounts with MFA method for each |
| Do you use endpoint detection and response (EDR)? | A behaviour-based EDR tool on every laptop, desktop and server, monitored by someone. Basic antivirus usually does not count | EDR console export showing device coverage |
| Are backups encrypted, offline or immutable, and tested? | At least one copy that ransomware with admin rights can't delete, plus a recent test restore | Backup job report; dated restore test record |
| How quickly do you apply critical patches? | A defined window (often 14 to 30 days) that you actually meet, including firewalls and VPNs | Patch compliance report; firewall firmware version |
| Do you have any end-of-life systems? | Any unsupported operating system or software still running, including that one old PC on the shop floor | Asset inventory with operating system versions |
| Is remote desktop (RDP) exposed to the internet? | A "no" must be true for every public IP address you own | External scan result |
| Do you verify payment and banking changes? | A written callback procedure using a known phone number, followed every time | Written procedure; staff sign-off |
| Do staff get security awareness training? | Regular training and phishing tests for everyone, including executives | Training completion report |
| Do you have an incident response plan? | A written plan with contacts, including the insurer's breach hotline, tested at least once a year | Plan document; tabletop exercise notes |
Read each question literally. "Do you require MFA" is not the same as "Do you offer MFA" or "Is MFA available." If even one account or access path is excluded, the accurate answer is usually "no" or "partially," with an explanation.
Where do small businesses get the answers wrong?
The most common errors aren't lies. They're reasonable-sounding answers that turn out to be incomplete when a forensic investigator looks at the environment after an incident.
"We have MFA" (but not everywhere)
This is the ICS mistake. MFA is turned on for most Microsoft 365 users, but a shared mailbox, an old service account or the remote access tool used by a vendor still signs in with a password only. Attackers look for exactly those gaps. Check MFA status for every account, and list every way someone can reach your systems from outside. Our multi-factor authentication service starts with that inventory.
"We have backups" (that ransomware can delete)
Many small businesses back up to a server or NAS on the same network, or to a cloud account that uses the same admin login. When attackers gain admin rights, they delete the backups first. Insurers increasingly ask for backups that are offline, immutable or held in a separate account, and they ask when you last tested a restore. Recent data shows why this question matters. In Coalition's 2026 Cyber Claims Report, 86% of businesses hit by ransomware refused to pay (Coalition, March 5, 2026). Refusing is only realistic when you can restore from clean backups. See our backup and disaster recovery service for what a recoverable setup looks like.
"We have EDR" (it's actually antivirus)
Free or basic antivirus is not endpoint detection and response. EDR records behaviour on each device and lets someone isolate a machine during an attack. Many questionnaires also ask whether the EDR is monitored around the clock. If no one watches the alerts, say so. Managed detection and response is how small teams cover that gap.
"We verify payment changes" (by replying to the email)
In Coalition's 2025 claims data, drawn from more than 100,000 policyholders in five countries including Canada, business email compromise and funds transfer fraud together made up 58% of all claims. Funds transfer fraud was the costlier of the two, with an average loss of US$141,000 (Coalition, March 5, 2026).
Insurers often ask whether you confirm changes to banking details by phone, using a number you already have on file. If your real process is "we reply to the email to double-check," the honest answer is "no." Some policies also cap or exclude social engineering losses unless a callback procedure was followed, so read that section of your policy too. Our guide to phishing beyond email covers why phone and Teams requests need the same check.
"Our IT provider said yes"
A quick "yes, we're good" from your managed service provider is not evidence. Your company, not your provider, answers to the insurer for what's on the form, and the signer confirms it on the company's behalf. Ask your provider to answer each question in writing, with screenshots or reports, and to flag anything they're unsure of.
How to complete your cyber insurance questionnaire: a 6-step process
Give yourself two to four weeks before the renewal deadline. Most of that time goes into collecting evidence and fixing small gaps you find along the way.
- Get the questionnaire early. Ask your broker for the insurer's actual application, not a summary. Different insurers word questions differently, and the exact wording decides the accurate answer.
- Assign an owner to every question. Your IT provider answers the technical ones. Finance answers the payment and banking ones. HR answers training and offboarding.
- Collect evidence before you answer. For each "yes," save the screenshot, report or document from the table above in one folder, dated. If you can't produce evidence, treat the answer as unconfirmed.
- Answer literally, and explain partial answers. Use the comments field or a cover letter. "MFA is enforced for all 42 Microsoft 365 users and the VPN. Two legacy service accounts are excluded and will be replaced by November 30" is far stronger than an unexplained yes.
- Review before signing. The signer should read every answer and ask, "Could we prove this tomorrow?" An independent review, such as a cybersecurity insurance evaluation, catches the gaps that people close to the environment miss.
- Keep the signed copy and the evidence folder. You'll need it at renewal, and if you ever file a claim. Set a reminder to re-check the answers whenever something big changes, such as a new office, a new system or a new IT provider.
Many insurers also scan your internet-facing systems from the outside, so fix what anyone can see first: exposed remote desktop, unpatched VPNs and old firewalls. Regular external scanning through a vulnerability management service shows you much of what an underwriter's scan is likely to find.
What if the honest answer is "no"?
A "no" is not the end of your application. Usually it leads to a higher premium, a lower limit or exclusion for that risk, or a condition to fix the gap by a set date. Occasionally an insurer will decline, which is why a remediation plan matters. Any of these is better than a claim denied after an incident.
Many Canadian small businesses are in the same position. In an Insurance Bureau of Canada survey of 308 business owners and decision makers in August 2025, only 22% carried cyber insurance, and fewer than half (48%) had implemented any form of cyber defence (IBC, October 2025).
When you do have a gap, give the insurer what an underwriter needs to say yes:
- A dated remediation plan. Name the control, the person responsible and the completion date.
- Compensating controls. If an old system can't take MFA, explain how it's isolated, for example on a separate network with no internet access.
- Progress since last year. Underwriters respond well to evidence that risk is going down.
The market has been in buyers' favour. Canadian cyber insurance rates fell 6% in both the first and second quarters of 2026 (Insurance Business Canada, September 29, 2026). A clean, well-documented application helps you take advantage of that softer market. A cyber security risk assessment before renewal gives you the plan and the evidence in one step.
Frequently Asked Questions
Who should sign the cyber insurance application?
Usually a senior officer, such as the owner, president or CFO, because the declaration confirms the answers are true for the whole company. The signer doesn't need to be technical, but they should review every answer and the evidence behind it before signing.
Can my IT provider fill in the questionnaire for me?
Your IT provider should answer the technical questions, ideally in writing with supporting reports. The company signing the application is still responsible for its accuracy, so review the answers rather than forwarding the form and signing what comes back.
What happens if I make a mistake on my cyber insurance questionnaire?
Tell your broker as soon as you find it. Correcting an answer before an incident is far better than having it found during a claim, when a material misstatement can lead to a denied claim or a rescinded policy, as in Travelers v. ICS. This article is general information, not legal advice. Ask your broker or lawyer about your specific policy.
Do I need to tell my insurer when my security changes during the policy year?
Check your policy wording. Many policies require you to report material changes, and some include conditions, such as MFA requirements, that apply for the whole policy period. If a control lapses mid-year, fix it quickly and ask your broker whether you need to notify the insurer.
Your next renewal, done right
Your cyber insurance questionnaire is the insurer's picture of your business. Make sure it's accurate:
- Read every question literally, especially the ones on MFA, backups and EDR.
- Back every "yes" with evidence you could hand over tomorrow.
- Disclose gaps with a dated plan instead of rounding up.
- Re-check your answers when your environment changes, not just at renewal.
For a wider look at the controls that matter most this year, see the 2026 small business cyber survival guide.
Want us to check your answers before you sign?
Cynerra reviews cyber insurance questionnaires for Canadian small businesses. We check each answer against your actual environment, gather the evidence and give you a dated plan for any gaps, before your renewal deadline. Book a short call, email [email protected] or contact us.
