GuideSecurity · 7 min
Our cyber insurance renewal wants MDR, MFA and tested backups. Where do we start?
Start with your insurer's questionnaire: every 'no' becomes a line in your plan, and the providers that fit bid to close it, well before your renewal date.
The Clectiv team ·
The questionnaire is your project plan. Insurers ask for specific controls before they'll quote, and a "no" can mean a higher premium, an exclusion, or no offer at all. Close the gaps in the right order, before the renewal date.
What do insurers ask for at renewal?#
Controls, by name, with a yes or a no next to each. Every insurer's questionnaire is its own, but they cover the same ground. Marsh, the insurance broker, says insurers are asking more questions than ever about applicants' controls. It also says certain controls have become a minimum that insurers expect before they'll cover you.
Marsh's April 2022 list names twelve key controls. They fall into four kinds:
| Kind | What it covers |
|---|---|
| Access | Who can log in, from where, and with what second check, like a code on your phone. Admin accounts most of all. |
| Detection | Software on every device that spots an attack, and someone reading what it finds, day and night. |
| Recovery | A backup attackers can't reach, a restore you've tested, and a written plan for the day it happens. |
| People and suppliers | Staff who can spot the fake email, and vendors whose access to your systems is checked. |
The plan asks the rest, control by control, in your insurer's own words.
Read your questionnaire line by line. The wording decides what counts. "MFA on email" and "MFA on everything" are different answers, and so are "we have backups" and "we've tested a restore."
Get it early. Ask your broker for the questionnaire months before the renewal, not weeks. Every gap you find early is one you can close in time.
Before you call anyone#
The questionnaire goes into Clectiv AI before any security provider sees it. Then Clectiv AI runs the process: it bids the work out to the providers that fit, they compete, and you choose. Show it to one first and you get its bundle, sized to what it sells, with your renewal date doing its closing for it.
Which gaps do we close first?#
The ones that decide whether you get a quote at all. Then the ones that move the price. Marsh puts multifactor authentication for remote and admin access first on its list, and calls it a key starting point.
A tool nobody watches doesn't count for much. Detection software that no one reads at night is a "yes" on paper and a gap in practice. That's where MDR comes in: people behind the tool, around the clock.
Close what you can before the renewal, and write a dated plan for the rest with Clectiv AI. A gap with a funded plan and a live date reads very differently from a blank. The plan puts the remaining controls in order.
How do we show the insurer it's done?#
Keep proof for every line you answer yes. The insurer may ask for it at renewal, and you'll want it even more if you ever file a claim.
Proof is a report, a date, or a document. Think of a report that a control is on for everyone, the date of your last restore test, or a provider's monthly summary. Clectiv AI's plan keeps track of which control needs which, so it's ready when the insurer asks.
Some insurers also scan what's visible from the internet. Open remote-desktop ports and old, unpatched systems show up before anyone reads your answers. Those are the easiest gaps for anyone to find, so close them first.
LevelBlue, BlueVoyant, AgileBlue and Thrive sell MDR and managed security. Zscaler sells secure access, and Cloudflare sells secure access and email security. Each is one of our security providers, and Clectiv AI runs the process for you from start to finish: start a project.
Use what others already learned. Clectiv AI runs the process we've run for customers like you, so you start where they finished. These providers see the plan directly, which is how you get the best pricing, terms and contract we can get.
Common questions#
Can you help with our cyber insurance renewal?#
What security controls do cyber insurers require?#
What happens if we answer no to a control?#
Do we need MDR for cyber insurance?#
What proof will our insurer want?#
How does Clectiv AI get this done?#
Bring it to Clectiv AI. Bring the questionnaire and the renewal date. It scopes the gaps with you and writes your plan: each question, what proves it, what's missing, and who closes it.
Then the Clectiv team takes your plan to the security providers that fit, all at once, through our partner network of 620+ providers. Those providers bid and compete, the team pushes on terms before anything gets signed, and you choose.
Other buyers already wore this path in. Clectiv AI runs the process we've run before, so you start where other buyers ended up. Then the providers that fit see the plan directly, for the best pricing, terms and contract we can get on each.
It's free to you, and the bids come back in days, not months. The rest of what we source in security is on the security page.
Sources and method. The controls and the insurer quote are Marsh's, from the document listed below. No prices appear in this guide. Provider names are examples of who sells managed security, from Clectiv's provider directory, not a ranking.
- Marsh, "Cyber resilience: Twelve key controls to strengthen your security" (April 2022)