Cyber risk readiness

Cyber insurance readiness checklist

Cyber coverage is not a substitute for security controls. A useful preparation process connects the data and systems you rely on with the controls, response plans, and vendor relationships you can document.

Document the basics

Assemble an evidence packet

Keep current, non-sensitive evidence that supports the answers in an application: an access-control summary, backup and restore notes, incident-response contacts, vendor list, security training records, patching cadence, and any independent assessment. Do not place passwords, recovery codes, or confidential customer data in a quote request.

Questions to ask about the policy

• What events trigger coverage: breach, extortion, system failure, fraud, or social engineering?
• Are breach response, notification, legal, forensic, restoration, and business interruption services included?
• Which security controls are required as conditions of coverage?
• Are vendors, dependent systems, funds transfer, and reputational impacts addressed or excluded?
• What notice process applies if a business suspects an incident?

What this checklist cannot determine

A completed checklist does not prove that a business is secure, eligible, or covered. Policy wording, application representations, exclusions, waiting periods, sublimits, and claims conditions control the outcome. Confirm material answers with the relevant technical and licensed insurance professionals.