Cyber Insurance Readiness Review
Prepare accurate, evidence supported answers for your cyber insurance application.
Identify security and documentation gaps before renewal, without guessing what your controls actually cover.
Fixed quote based on your questionnaire, environment and deadline.
Begin with the actual requirement
Your insurer’s questionnaire determines the review.
Cyber insurance questions and evidence requirements vary. We begin with the documents you have received, the systems they apply to and the submission deadline. We then identify answers that need evidence, clarification or remediation.
Questionnaire
The current application, renewal form or security declaration.
Policy context
Relevant security conditions, prior answers and questions for your broker or insurer.
Deadline
The time available for evidence collection, clarification and possible remediation.
Choose the right review
Three services with different purposes.
| Service | Primary purpose | Best starting point |
|---|---|---|
| Cyber Risk Health Check | Broad cybersecurity risk visibility | No recent structured security review |
| Essential Eight Readiness Assessment | Framework-specific readiness and evidence | Essential Eight is an explicit requirement |
| Cyber Insurance Readiness Review | Prepare for a specific questionnaire or renewal | An application, renewal or insurer request is approaching |
Review areas
Examine the controls behind your answers.
The final scope follows your questionnaire and written proposal. Common review areas include:
Identity and MFA
MFA coverage, user accounts, privileged identities and access management practices.
Administrator access
Elevated privileges, remote access and controls around sensitive administrative activity.
Backup and recovery
Backup coverage, isolation, protection, recovery responsibilities and testing evidence.
Patching and vulnerabilities
Processes for identifying, prioritising and addressing relevant vulnerabilities and updates.
Endpoint protection
Device protection, monitoring responsibilities and available evidence of control operation.
Incident response
Response plans, contacts, escalation paths and preparation for a security incident.
Policies and awareness
Relevant security policies, staff responsibilities and awareness activities.
Cloud and suppliers
Relevant outsourced services, cloud controls and third-party security responsibilities.
Our accuracy principle
We help you understand and evidence your controls. We do not recommend answering “yes” unless the answer is supported by the agreed evidence.
What you receive
A practical readiness pack for clearer decisions.
Questionnaire response review
Security-related questions reviewed for clarity, scope and supporting evidence.
Evidence checklist
A record of relevant evidence available, missing or still requiring confirmation.
Ambiguous-answer register
Answers that may be unsupported, incomplete or dependent on interpretation.
Prioritised remediation actions
Practical security improvements ordered by urgency and dependency.
Broker or insurer questions
Items that should be clarified by the appropriately authorised insurance professional.
Readiness summary and review
A business-focused summary followed by a guided findings discussion.
How it works
From questionnaire to evidence-backed action plan.
Share the requirement
Provide the current questionnaire, relevant policy material, previous answers and deadline.
Confirm scope
Agree the systems, stakeholders, evidence, deliverables, timeframe and fixed price.
Review controls
Examine agreed technical controls, practices and available documentation.
Identify gaps
Record answers that need evidence, clarification or corrective action.
Deliver the pack
Receive the readiness summary, evidence checklist and prioritised actions.
Clarify insurance matters
Refer policy interpretation, coverage and application decisions to your broker or insurer.
Pricing and timing
A fixed quote before review work begins.
Pricing depends on team size, systems, questionnaire complexity, evidence availability and the time remaining before submission.
Begin before the renewal deadline where possible. Remediation may require configuration changes, supplier involvement, testing or new documentation.
Your written proposal confirms:
- Questionnaire and systems included
- Stakeholders and evidence requirements
- Deliverables and findings review format
- Expected delivery schedule
- The fixed price for the agreed scope
Remediation, penetration testing and insurance advice are not automatically included.
Who it’s for
Useful when insurance questions need evidence, not assumptions.
Upcoming renewals
Review current answers and controls before the submission deadline.
First-time applications
Understand the technical questions and identify evidence requirements early.
Detailed questionnaires
Work through security questions that span multiple systems or providers.
Changed environments
Reconsider prior answers after migrations, growth, new suppliers or operational changes.
Unsupported prior answers
Identify statements that no longer appear clearly supported by current evidence.
Control concerns
Review uncertainty around MFA, backups, patching, monitoring or incident readiness.
Frequently asked questions
What to know before the review.
Can you complete the insurance application for us?
We can review security-related questions and help you understand the relevant controls and evidence. The applicant remains responsible for the accuracy and approval of submitted answers, with insurance matters referred to the broker or insurer.
What evidence will we need?
Requirements vary by questionnaire and scope. Evidence may include relevant configurations, system records, policies, test results and information from technology providers.
What if we cannot accurately answer “yes”?
We document the gap and practical next steps. Your broker or insurer should advise how the question must be answered and whether further information is acceptable.
Can you speak with our broker?
With your permission, we can help explain technical controls and findings. We do not provide insurance advice or make policy decisions.
Is remediation included?
No. Remediation is separate unless explicitly included in the written scope. Additional implementation work is agreed and quoted before it begins.
How early should we begin?
As early as practical after receiving the questionnaire. The available time affects how much evidence can be gathered and whether gaps can be addressed before submission.
Does this guarantee coverage or claim acceptance?
No. Insurers determine applications, terms, exclusions and claims. The review provides cybersecurity readiness guidance only.
How is sensitive information handled?
Information and access requirements are agreed during scoping. Only material relevant to the review should be provided, using the agreed transfer and access arrangements.
Related guidance
Understand the controls behind common insurance questions.
Prepare before the deadline
Request your Cyber Insurance Readiness Review.
Send us the questionnaire, relevant deadline and a short description of your environment. We’ll confirm whether the service fits and provide a defined scope and fixed quote.