Your application is a sworn description of your environment. File a claim and an adjuster reads it again, then approves or denies it on the answers you gave.
The same controls that get you covered keep you from filing
Verifying them earns a premium priced on what you hold, and coverage that responds when you need it. Underwriters did not invent this list. Every question on it comes from a claim they have already paid.
58%
of cyber incidents were business email compromise or funds transfer fraud, not ransomware. This is why the application asks so much about multi-factor authentication and email security.
86%
of businesses refused to pay the ransom. You can only refuse if your backups cannot be deleted and your last restore test worked.
64%
of closed claims were resolved with no out-of-pocket loss to the business. Coverage works when the application behind it was accurate.
$202K
recovered on average when stolen funds were clawed back. How much comes back depends on how fast the fraud is caught and reported.
Source: Coalition 2026 Cyber Claims Report, 2025 claims. Coalition underwrites cyber coverage, so these are a carrier’s own claims numbers, not a vendor survey.
For architecture, engineering and design firms
What changes if you are an architecture or engineering firm?
The eleven controls below are the same whatever your firm does. What differs is what a carrier believes you are holding, and what your clients have already put in writing.
A design practice carries models and drawing sets that a project cannot move without, payment instructions moving between owner, architect and contractor, and increasingly a security exhibit written into the owner and architect agreement. That combination puts funds transfer fraud and loss of document access ahead of ransomware among the things most likely to cost you money, which is why the application asks what it asks.
Your professional liability policy does not answer for any of it. What that leaves uncovered, and what the AIA digital practice exhibits expect of you, is set out on the architecture firms page.
What carriers actually verify
Eleven controls, and what a truthful yes requires
Nearly every cyber application in 2026 asks these questions, and the wording is strict. Your answers can decide whether a claim gets paid. Open any row to see what a truthful yes requires.
1
Multi-factor authentication, everywhere it is asked about
MFA on Microsoft 365 or Google Workspace, on the VPN and any remote desktop gateway, on your firewall and hypervisor consoles, and on every account carrying administrative rights. Legacy authentication that bypasses MFA has to be switched off.
2
Endpoint detection on servers as well as laptops
The agent runs on every workstation and on every server, virtual machines included. Alerts reach a named person or service who acts on them.
3
Backups an attacker cannot delete
At least one copy that production credentials cannot alter or delete, including a domain administrator account. A copy ransomware can reach from inside the network does not satisfy the question.
4
A restore you have actually tested
A documented restore of real production data within the last twelve months, with the elapsed time recorded.
5
Email authentication enforced, and not only published
All three published, with DMARC set to quarantine or reject, on every domain you own. A policy of p=none is monitoring, not enforcement. Dormant domains you never send from get spoofed too, so include them.
6
Administrator accounts kept separate
Administrators hold a second account for administrative work and do their day-to-day work in a standard one. Keep the number of privileged accounts small, and review the list on a schedule.
7
Everyday accounts stripped of local administrator rights
Carriers want a no here. Staff sign in as standard users, which means they cannot install software or switch off the endpoint agent. Document any exception and give it an expiry date.
8
A patch schedule you can evidence
A stated window that you meet, covering servers and network equipment as well as workstations. Firewalls and VPN appliances are the devices most often left out of a patch cycle.
9
Cybersecurity awareness training, run on a schedule
Training that repeats on a schedule and covers everyone, leadership included. Track the results so you can see which way they are moving.
10
Enough log history to reconstruct an incident
Retention long enough to investigate an incident you discover late, covering authentication events along with endpoint and firewall activity. Ninety days is the common floor.
11
An incident response plan with names in it
A written plan with named roles and contact details that still work when email is down. Run it at least once as a tabletop exercise before you need it.
Where applications go wrong
The answer that causes trouble is a yes that is only partly true.
A no on the form costs you a higher premium, or a condition to meet before cover starts. A yes that is only mostly true lets the carrier void the policy for misrepresentation and get your claim denied, as in Travelers v. ICS, 2022.
Somebody should verify every answer on it before a director signs.
What happened in Travelers v. ICS, 2022
This is not hypothetical. In 2022 Travelers went to federal court* to rescind a cyber policy, alleging the insured had represented that multi-factor authentication was in place across its systems when it was not. The parties agreed to have the policy declared null and void from inception.
*Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 22-cv-2145 (C.D. Ill.), filed 6 July 2022.
The four partial answers we find most often
Multi-factor authentication on email, but not on the VPN, the firewall console or the hypervisor.
Backups running and reporting success, with no restore tested in over a year.
Endpoint detection on laptops, with the file server and the domain controller left out.
DMARC published at p=none, which reports on spoofing without stopping any of it.
How the engagement runs
Four steps, finished before your renewal date
Start ninety days out and count backward. That leaves time to close what the questionnaire finds, with a month of slack ahead of the deadline.
Read the actual documents
Your current policy read all the way through its conditions and exclusions, past the declarations page, and the renewal questionnaire in front of you. Requirements vary by carrier, so we work from yours.
Test every attested control
We check each control against the question as written, since the wording usually asks for more than having it. This step is built to catch gaps in multi-factor authentication and untested restores.
Close the gaps
Configuration changes first, since most of this list comes down to settings you already own. Anything that needs budget or a project starts here, with months of room.
Hand over dated evidence
Screenshots, configuration exports, restore-test records and DNS results, dated and organized question by question, so your broker can point to something for every answer.
Where our work ends
We work alongside your broker, and stop where they begin
We test the controls, close what we can and document the result. Your broker takes it from there and places the coverage. If you already have a broker, keep them. If you need an introduction to a cyber specialist, we can make one.
What you receive
What you get at the end
11 controls
Each one tested in your environment and marked verified, partial or absent, against your carrier’s own wording.
1 evidence pack
Dated exports and records, ordered to match the application itself, so nothing on it goes unanswered.
90 days
The window we ask for before a renewal, leaving four weeks in hand.
Already looking at your wider technology picture? The JOUST assessment covers fifteen domains.
The eleven controls above, written out as the questions your carrier will ask, with the evidence that proves each one and a ninety day renewal timeline.
Get the guide
Common questions
Do you sell cyber insurance?
No. Your broker places the coverage, including the one you already have. We do the technical half: testing the controls you attest to, closing what we can before the deadline, and documenting the result for the underwriter.
What controls do cyber insurance carriers require in 2026?
Most applications turn on eleven: multi-factor authentication, endpoint detection and response, immutable or offline backups, a tested restore, email authentication with DMARC enforced, separate administrator accounts, local administrator rights removed from everyday accounts, an evidenced patch schedule, cybersecurity awareness training with phishing simulation, logging and retention, and a written incident response plan. The exact wording differs by carrier, which is why we work from your questionnaire and never from a generic list.
Our application asks whether we have MFA. We have it on email. Is that a yes?
Usually not. Most current wordings ask about email, remote access and administrator accounts together. Answering for email alone leaves two of the three unanswered. Where the question is ambiguous, write out what is true and let the carrier price it.
What happens if we answered something wrong on last year's application?
Tell your broker. A carrier that learns of an inaccuracy from you at renewal is in a very different position from one that discovers it while adjusting a claim. We can help you establish what is true first, so the conversation is a factual one. This is a question for your broker and your counsel as much as for us.
Will better controls lower our premium?
Pricing is the carrier's decision and we will not promise a number. What the controls reliably change is which carriers will quote you at all, what conditions and sublimits come attached, and whether coverage responds cleanly when you need it. Those are usually worth more than the premium line.
Do we have to be a managed services partner to do this?
No. The readiness review is a standalone engagement and plenty of firms run it with their existing IT team doing the remediation. We monitor systems around the clock for the partners we do manage.
What should a design firm ask its IT provider before a cyber renewal?
Ask for evidence rather than assurance. Which of the eleven controls are in place today, with an export or a screenshot for each. Whether multifactor reaches the VPN and the remote desktop and not only email. When a restore was last performed on your own equipment, and how long it took end to end. Who signs the answers on the application, and what happens if one of them turns out to be wrong at claim time. A provider who cannot produce that evidence before your renewal date will not produce it during a claim.
What should an architecture firm’s cyber policy cover?
That one belongs to your broker, and the answer depends on what you hold and what your client agreements already oblige you to carry. What we can tell you is what the application asks about: funds transfer fraud and social engineering, business interruption while a model or a drawing set is unavailable, breach response costs, and any obligation flowing from a security exhibit attached to an owner and architect agreement. Get those answers true first. Coverage priced on answers that do not hold is the coverage most likely to fail at the moment you need it.
Renewal coming up?
Send us the questionnaire. A fifteen-minute call is usually enough to tell you which answers hold up.
