For a Texas business, the cyber insurance application is now mostly a security questionnaire. This guide covers the cyber insurance requirements behind it, the 8 controls applications ask about most, and the proof to have on file before anyone signs. It comes from the team that builds those controls as part of cybersecurity services in Texas. We’re not an insurer.
A cyber insurance application asks whether specific security controls are in place, usually MFA, endpoint detection, tested backups, patching, email security, training, an incident response plan, and limits on admin accounts. Each yes needs proof you can still produce after a claim.
That second part hurts businesses. The form gets signed in a hurry, often by an owner or CFO taking IT’s word for it. Nobody inside the business checks the answers. Not until something breaks and the insurer reads them again.
What does a cyber insurance application or questionnaire ask?
A cyber insurance application, sometimes called a cyber questionnaire, is the underwriting form an insurer uses to decide whether to cover you and on what terms. It asks what data you hold, how you protect it, how money leaves the business, what’s gone wrong before, and whether the person signing can stand behind every one of those answers a year later. Controls carry the most weight.
Wording changes from carrier to carrier. The themes don’t. These are typical, with sample language from real applications.
- How much sensitive data you hold, as in “For how many individuals does the Applicant store or process sensitive information?” Count old customer files too. They’re still records.
- Which kinds. Driver’s license and Social Security numbers, bank account and card data, protected health information, and stored username and password pairs.
- Whether data on servers and databases is encrypted, and whether written policies govern how it’s stored and moved.
- Compliance, meaning HIPAA, your PCI DSS level, and whether card processing is fully outsourced.
- Funds transfer controls. One application we’ve seen asks whether every wire over $25,000 needs sign-off from at least 2 employees before it goes out.
- The security controls themselves, which the table below breaks apart one by one.
- Media exposure, such as licensed images on your website and whether anyone reviews content before it’s posted.
- Loss history over the last 3 years, plus anything you already know of that could turn into a claim.
People rush the loss history question. Don’t. A phishing incident your team cleaned up 2 years ago can still meet the form’s definition of a cyber event, even though no claim was ever filed or reported to anyone outside the building. Disclose it anyway.
What are the cyber insurance requirements carriers ask about?
Cyber insurance requirements are the security controls an insurer expects before it will cover you, most often MFA, EDR, tested backups, patching, email security, training, an incident response plan, and limited admin access. That’s the short list.
The same 8 controls come up again and again. They also line up almost one for one with CISA’s #StopRansomware Guide, which tells every organization to keep offline, encrypted backups and test them, use phishing-resistant MFA, patch internet-facing systems first, train staff to spot phishing, and exercise a written incident response plan. Same list, different source.
Read the third column closely. It’s where businesses get tripped up.
| Control | How the question usually reads | Where an honest answer goes wrong | Proof to keep on file |
|---|---|---|---|
| Multi-factor authentication | Is MFA required for email, remote access, and every admin account? | Staff email has it, but the VPN, a forgotten admin login, or a service account set up years ago doesn’t | An MFA or conditional access report from Microsoft 365 or your identity provider, with every exception named |
| Endpoint detection and response (EDR) | Is EDR installed on all laptops, desktops, and servers? | Plain antivirus gets counted as EDR, or the agent never made it onto 3 machines nobody remembers | A device export from the EDR console whose count matches your asset inventory |
| Backups and tested restores | Are backups kept offline or with a cloud provider, and has a restore been tested? | Jobs run every night, yet nobody has restored anything in over a year | Backup job history plus a dated restore test showing what was restored and how long it took |
| Patching cadence | How quickly do you apply critical security patches? | Windows updates itself, while the firewall, the VPN appliance, and third-party apps sit months behind | A patch compliance report and your written window for critical fixes |
| Email security | Do you filter inbound mail and authenticate your domain? | A spam filter runs, but DMARC is set to p=none, so spoofed mail in your name still lands | Your published SPF, DKIM, and DMARC records and the filtering policy |
| Security awareness training | Does every employee get phishing training? | One video at hiring, and no test phish sent to anyone since | Completion records by employee and your latest phishing simulation results |
| Incident response plan | Do you have a written incident response plan, and has it been tested? | A downloaded template exists, but it never says who calls the insurer first | The plan, the date of its last tabletop exercise, and the insurer’s breach hotline written into it |
| Privileged access control | Are admin rights limited and kept separate from everyday accounts? | The owner’s daily login is also the global admin | A list of admin accounts, who uses each one, and when the list was last reviewed |
See the pattern? Nearly every bad answer is a partial yes. The control exists. It just doesn’t reach everything the question covers, and the form never asks how far it reaches.
No single carrier’s form is reproduced here, and the list doesn’t speak for any one insurer. It reflects what applications commonly ask. On pricing, the most anyone should say is what the National Association of Insurance Commissioners did in its 2025 report on the cyber insurance market, that continued investment in security controls “is looked upon favorably by underwriters.” Favorably. Not a promised discount.
What happens if an answer on the application is wrong?
A 2022 federal case shows how bad it can get.
In July 2022, Travelers asked a federal court in Illinois to rescind a cyber policy it had issued to International Control Services. The application, signed by the company’s CEO, said MFA protected administrative and privileged access. After a ransomware attack that May, Travelers said it learned MFA protected the firewall and nothing else. ICS agreed to rescission. The court then entered judgment declaring the policy void from inception, as the National Law Review later summarized it.
Void from inception means the policy is treated as if it never existed. No coverage. Not for the attack that prompted the claim, and not for anything else.
A wrong answer doesn’t always end that way. Some policies carry what the NAIC’s 2024 cyber market report calls a “failure to maintain security” exclusion, which can rule out claims that stem from an insured’s failure to keep minimum or adequate security standards in place. Different mechanism. Same timing. You find out in the middle of an incident.
Our honest take? A “no, rolling out by March 1” beats a hopeful yes every time. Ask your broker how a given carrier treats a control that’s still being deployed. You may get a narrower quote. You won’t get a policy built on an answer that can’t survive a claim.
What should be on your cyber insurance checklist before you apply?
Pull this together before anyone opens the form. If your IT is well documented, it’s an afternoon of exports. If it isn’t, plan on a few weeks. Start early.
- A device inventory with laptops, desktops, and servers counted separately
- The EDR console export, checked line by line against that inventory
- An MFA report covering email, VPN, remote desktop, and every admin account, with exceptions listed by name
- Every admin account and the person behind it
- Backup job history and the date, scope, and result of your last restore test
- Your patch compliance report and the written window for critical patches
- SPF, DKIM, and DMARC records and the policy each one is set to
- Training completion by employee and the results of your last 2 phishing simulations
- The incident response plan, the date it was last exercised, and the hotline or vendor you’d call first
- Your written procedure for verifying wire transfers and changes to payment instructions
- Record counts by data type, covering Social Security numbers, card data, health records, and stored passwords
- Every security incident from the last 3 years, claimed or not
Keep the pack. Date it. Store it somewhere safe. Next year’s renewal questionnaire will ask the same things, and last year’s pack shows you exactly what to re-check.
Two items on that list cause more trouble than the rest. First, restore tests. A backup that’s never been restored is a guess. Can you say how long a full restore would take? If not, work through these questions to ask your MSP about backup before you answer. Second, email authentication. Plenty of businesses set it up once and never finish. Our guide to Microsoft 365 email security settings walks through the switches that matter.
How does Texas law line up with the same controls?
We know of no Texas law that makes a private business carry cyber insurance. Protecting data is another story. The proof Texas rewards is the same proof an underwriter wants. What keeping that proof current costs each month is laid out in our guide to cybersecurity services cost in Texas.
Section 521.052 of the Texas Business and Commerce Code says a business “shall implement and maintain reasonable procedures” to protect sensitive personal information, and the Attorney General can seek $2,000 to $50,000 per violation. Financial institutions covered by the Gramm-Leach-Bliley Act are carved out of that section. Notice deadlines apply to everyone. After a breach, the clock is 60 days to notify affected people and 30 days to notify the Attorney General once 250 or more Texans are involved.
Then there’s Chapter 542. Added by Senate Bill 2610 and in effect since September 1, 2025, it protects businesses with fewer than 250 employees. If one shows it ran a qualifying cybersecurity program when a breach happened, a person harmed by that breach can’t recover exemplary damages from it. The program has to follow a recognized framework, scaled to headcount. Small firms get simpler rules.
| Employees | What Chapter 542 expects at a minimum | Overlap with the application |
|---|---|---|
| Fewer than 20 | A framework-based program that includes password policies and employee cybersecurity training | Training and written password policies |
| 20 to 99 | A program that includes CIS Controls Implementation Group 1 | Most of the 8, including MFA, backups, patching, training, admin accounts, and incident response |
| 100 to 249 | Full conformance with a framework such as the NIST Cybersecurity Framework, the CIS Controls, ISO 27001, or SOC 2 Type 2 | All 8, documented to a framework |
Know the limits. The safe harbor blocks exemplary damages and nothing else. It doesn’t stop a lawsuit, a regulator, or an insurer’s coverage decision. But since the evidence pack does double duty, building it once covers both. That’s our reading of the statute, not legal advice.
Who should fill out the application, and how long does it take?
Three people, usually. The owner or CFO signs. Your IT provider drafts the control answers. Your broker explains what each answer does to the quote, which carriers will accept a control that’s still rolling out, and what the policy will and won’t pay for if the worst happens. When one person fills out the whole form alone, mistakes slip through.
The form itself takes a few hours to a few days. Evidence takes longer the first time, because the pack doesn’t exist yet. After that, renewals move fast.
The question list in the first version of this guide came from Crandall & Associates, an insurance agency that helps businesses with the policy side of cyber coverage. For what a policy actually pays for once you have one, which can include forensics, customer notification, lost income, and lawsuits from third parties, read our explainer on how cyber insurance protects your business.
Where does an IT provider fit in?
We build controls. We don’t sell policies, and we won’t sign your application. Our job is narrower. We put the 8 controls in place, keep them running, and hand over the evidence pack, so whoever signs can check each answer against a report instead of a hunch.
If you have in-house IT that can pull MFA reports, EDR exports, and a dated restore test in a single day, you probably don’t need outside help with this, and we’d rather tell you that up front. Businesses without that person on staff are the ones we usually work with.
Every control has a guide. Start with a cybersecurity risk assessment if you’re not sure where you stand. Confused by the EDR question? Read EDR vs MDR vs XDR before you answer it. The access questions map to a zero trust security model, our data backup services include scheduled restore tests, and a data breach response plan for Texas businesses covers the incident response question. Broader questions about outsourcing IT are in our managed IT services FAQ.
When you’re ready to close the gaps, our managed cybersecurity services cover all 8 controls, and our average response time is 5 minutes when something needs attention. Or talk to our team about a review before your renewal date.
Cyber insurance application questions, answered
How long does a cyber insurance application take to complete?
A few hours for the form itself, if your evidence is ready. The first year usually takes longer because the evidence pack has to be built from scratch. Renewals go faster when you’ve kept last year’s pack and only need to update dates and counts.
Do I need every control in place to get coverage?
That depends on the carrier, and only your broker can tell you which gaps a given insurer will accept. Accuracy is yours to control. A truthful no with a rollout date keeps the record clean, while a yes you can’t back up puts the whole policy at risk.
What happens if I answer a question inaccurately?
The insurer can deny a claim or ask a court to rescind the policy. In the 2022 case Travelers brought against International Control Services, the policy was declared void from inception after the insurer said MFA covered only the firewall, not the admin access the application described.
Who should fill out the security section, me or my IT provider?
Your IT provider should draft it, and you should check it before you sign. Ask for the report behind each yes. If nobody can produce one, treat that answer as a no until someone can.
Does antivirus count as EDR on an application?
No. They’re different tools, so answer the question the form actually asks. Traditional antivirus matches known malware, while endpoint detection and response watches behavior and lets someone isolate a machine remotely. If you only run antivirus, say so.
Is a renewal questionnaire as important as the first application?
Treat it with the same care, because it covers the same ground. Re-run the evidence pack instead of copying last year’s answers, since staff, devices, and admin accounts change every year.
Does a small business need cyber insurance?
Only you can weigh that, but a client contract or a lender can settle it by asking for proof of coverage. If you’re still deciding, start with what a policy pays for, and our guide to what cyber insurance covers walks through it. Once you’ve decided, the 8 controls above are what the application will ask about.
Is cyber insurance mandatory for Texas businesses?
We know of no Texas law that makes a private business carry cyber insurance. What Texas does require is reasonable procedures to protect sensitive personal information under Business and Commerce Code section 521.052, plus breach notices within 60 days to affected people and 30 days to the Attorney General when 250 or more Texans are involved. Contracts are a separate matter, since a client or lender can require coverage.
Not sure every yes on your application would hold up? We’ll check your controls against the 8 questions above, flag the partial yeses, and hand you the evidence pack your signer needs. Any size, any industry, anywhere in Texas.
Book a Security Controls Review
