Somewhere in a folder, or in an email thread nobody wants to reopen, there is a cyber insurance application with your company's name on it. On that form, somebody checked a lot of boxes.
MFA is enabled. Backups are tested. Endpoint protection is on every machine. There is an incident response plan.
Maybe all of that is true. Maybe some of it was true the day the form got filled out. The problem is what happens after an incident, when the carrier starts asking for proof.
The form is not paperwork. It is a claim about your controls.
Insurance applications get treated like admin work. The broker sends a form, someone who knows the systems well enough fills it in between other jobs, and it goes back so the policy can renew on time.
But those answers carry weight. If a ransomware event hits and the carrier finds that MFA was never turned on for remote access, or that backups were running but never tested, the conversation changes fast. Now it is not just an incident. It is a dispute about whether the answers on the application matched reality, and claims have been denied or fought over for less.
I am not a lawyer and this is not legal advice. It is an operations problem, and operations is where it gets fixed.
Four yeses worth checking this week
You do not need a six month project to get honest here. Start with the answers most likely to be stale.
First, MFA. Is it on for email, for the VPN, and for every admin account? Not planned, not available in the plan you bought. On, enforced, and with no quiet exceptions for the owner, the office manager, or that one service account nobody wants to touch.
Second, backups. When was the last successful restore, and who saw it happen? A backup job that reports success is a claim. A restored file, server, or mailbox, with a date next to it, is evidence.
Third, endpoint protection. Is it actually installed and reporting on every laptop and server, including the one in the back office and the laptop someone bought themselves during a busy week? Partial coverage is the normal state of things unless somebody checks.
Fourth, the incident plan. Does a written plan exist, does it name who calls whom, and could anyone find it at 2 AM without the network? A plan that lives only on the file server it is supposed to help you recover is not much of a plan.
Why good companies get this wrong
Nobody sets out to misstate anything. What usually happens is drift.
The form got answered when a control was half rolled out, and the rollout quietly stalled. A vendor said a feature was included, and nobody confirmed it was switched on. The person who filled out the application last year left, and this year's renewal copied last year's answers because they looked reasonable.
That is why this is a governance job, not a forms job. Controls change every month. The application should be rebuilt from current evidence at every renewal, not copied forward.
Make proof a habit, not a scramble
Keep a short evidence file next to the policy. Screenshots or exports showing MFA enforcement. The date and result of the last restore test. A coverage report from your endpoint tool. A copy of the incident plan, printed, with names and phone numbers that are still current.
Update it quarterly. It takes an hour when nothing is on fire. After an incident, when the carrier, the bank, and your own customers are all asking questions at once, that hour turns into days you do not have.
Then do the uncomfortable part. If an answer on the current application is not true today, fix the control or fix the answer, and tell your broker before renewal rather than after a claim. Brokers would much rather help you close a gap in October than argue about one in the middle of a breach.
Your cyber policy is only as good as the controls behind it. The form already says who you claim to be. The work is making sure the systems agree.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.