Know your insurance application is true before you sign it
Updated October 19, 2026 · BoiseCyber team
Your renewal application asks about MFA, backups, endpoint protection and incident response. Your signature says those answers are true. In Travelers v. ICS, a company's application said MFA protected its admin access. After a ransomware attack, the insurer found MFA covered only the firewall. The case ended in an agreed court order that voided the policy from day one.
What you get (two weeks)
- A question-by-question check of your application against what's really in place
- An evidence folder for each control you claim
- A short fix list for anything that isn't true yet, in order of what the carrier cares about most
- BEC First Response: a one-page playbook for a business email compromise: call the bank, report to the FBI's IC3, notify your carrier
- IR Readiness: a short incident response plan, plus your insurer's panel vendors and breach counsel written down before you need them
The controls your application asks about
Cyber insurance applications commonly ask about the same five controls. Here is what each question is really checking, and what you should have in hand before you answer yes.
| Control | What the application asks | What "yes" should mean | Evidence to keep |
|---|---|---|---|
| Multi-factor authentication (MFA) | Is MFA required for email, remote access and admin accounts? | Every user, every remote path and every admin login, with no exceptions you haven't written down | Screenshots of the enforcement policy and a list of any exempt accounts with the reason |
| Endpoint detection and response (EDR) | Do you run EDR on all endpoints and servers? | A detection and response tool, not only antivirus, on every laptop, desktop and server, with someone watching the alerts | Console export showing coverage count against your device inventory |
| Backups | Are backups offline or immutable, and tested? | At least one copy an attacker with admin rights can't delete, plus a restore you actually ran | Backup configuration and the date and result of the last restore test |
| Incident response plan | Do you have a written IR plan, and has it been tested? | A current plan with names and phone numbers, exercised in a tabletop within the last year | The plan, the tabletop date and the action items that came out of it |
| Privileged access | How are admin and service accounts controlled? | Separate admin accounts, a short list of who has them, and MFA on every one | Current admin account list with owners and last review date |
If any row isn't true yet, Renewal Ready puts it on your fix list in order of priority. We advise; you and your broker decide how to answer.
Why it matters
The FBI's IC3 counted about $3.05B in reported business email compromise losses in 2025. Business email compromise and funds transfer fraud made up 58% of Coalition's 2025 claims.
Price
Fixed fee, scoped on a short call.
We advise. You and your broker own the application, and we never sign or certify it for you.
FAQ
- What if one of our answers isn't fully true yet?
- Tell your broker before you sign. We help you document the gap and the fix date, which is far better than finding out after a claim.
- How far before renewal should we start?
- Earlier is better. Starting a few weeks before the application is due leaves time to close small gaps and collect evidence.