How to Answer a Cyber Insurance Questionnaire Honestly

Treat every answer on a cyber insurance application as a warranty, because carriers do. In July 2022 Travelers Property Casualty Company of America filed suit against International Control Services in the U.S. District Court for the Central District of Illinois, seeking to rescind a cyber policy (docket 2:22-cv-02145). The complaint alleges that ICS's application documents affirmed multi-factor authentication for all employees accessing email, for all remote network access by employees, contractors, and third-party service providers, and for internal and remote administrative access to directory services, backup environments, network infrastructure, and endpoints and servers, when in fact MFA protected only its firewall. Travelers says it learned this while investigating a May 2022 ransomware attack. The following month ICS agreed to a judgment rescinding the policy, as reported by Insurance Journal and Lockton.

Rescission is worse than a denied claim: the policy is treated as though it never existed. The practical rule that follows is simple and counterintuitive. A truthful "partially implemented, here is the scope and the completion date" is a better answer than a confident yes, because the confident yes is the one that gets tested by a forensic firm after a loss.

What follows is why an application behaves like a warranty, which controls actually drive underwriting decisions, how to write a partial answer that a carrier will accept, and when buying insurance is the wrong next purchase.

Key takeaways

• Application answers function as representations the carrier relies on; a material misstatement can support rescission, which voids cover retroactively.
• Travelers v. International Control Services is the concrete example: an overstated MFA answer, a ransomware loss, and an agreed judgment rescinding the policy in 2022.
• MFA scope is the most commonly overstated answer, because "we have MFA" usually means email only while the question asks about remote access, endpoints, servers, and directory services.
• Marsh McLennan's own research found automated hardening techniques the most effective control it measured, ahead of the controls insurers have historically asked about most, which tells you underwriting attention and control effectiveness are not the same ranking.
• Partial answers with a named scope and a completion date are routinely accepted. Overstated answers are what fail after a loss.

Why the application is not a form

Insurance underwriting is a pricing exercise built on information asymmetry: the carrier cannot inspect your environment, so it prices what you tell it. That is why insurance law across most jurisdictions gives a carrier remedies when the information it priced turns out to be wrong in a material way. Depending on the policy, the state, and the wording, those remedies range from a claim denial to rescission of the whole contract.

Two features of the cyber line make this sharper than in other insurance. First, the answers are unusually checkable after the fact. A forensic investigation following a ransomware event produces exactly the artifacts that show whether MFA was enforced, whether endpoint detection was deployed, and when the backups were last restored. Second, the application questions have grown far more specific in recent years, which narrows the room for a good-faith broad reading.

That combination is what turns a rushed answer into a live exposure. Nobody in the Travelers matter needed to prove intent to deceive to reach a rescission; ICS agreed to a judgment rescinding the policy, and the allegation was a representation that did not match deployment.

The Travelers matter, precisely

Because this case gets cited loosely, here is what is actually on the public record.

Travelers Property Casualty Company of America filed a Complaint for Rescission and Declaratory Judgment against International Control Services on 6 July 2022, in the Central District of Illinois, docket 2:22-cv-02145. Paragraph 15 of that complaint sets out the affirmations Travelers says ICS made: MFA required for all employees accessing email through a website or cloud-based service; MFA required for all remote network access provided to employees, contractors, and third-party service providers; and MFA required for internal and remote administrative access to directory services, network backup environments, network infrastructure, and the organization's endpoints and servers. Travelers alleges it learned during its investigation of a May 2022 ransomware event that ICS used MFA only on its firewall. The case terminated on 30 August 2022.

Two things this case is not. It is not a court ruling establishing new law on cyber misrepresentation, because it resolved without a decision on the merits: the docket records a motion for rescission and dismissal filed 26 August 2022, an order granting it four days later that dismissed the matter with prejudice with each party bearing its own costs, and judgment entered the same day. Insurance Journal and Lockton both report that ICS agreed to that outcome. And it is not a story about a company that lied elaborately; the reported gap is the ordinary one, an MFA answer broader than the deployment.

Secondary coverage of this case has been inconsistent about the venue, which is why the district and docket number above are taken from the docket rather than from the write-ups. The whole record is six numbered entries and is public.

The controls that actually drive the decision

Applications ask about a lot. A smaller set does most of the work in pricing and in the accept-or-decline decision.

Marsh publishes what it calls the top 12 controls "considered as best practices by cybersecurity experts and insurance carriers alike". Marsh McLennan's cyber risk analytics research, announced in April 2023, then measured which of those categories actually move the odds, and the ranking is not the one the application questions imply. Automated hardening techniques, which apply baseline security configurations to components like servers and operating systems, came first by a wide margin: organizations that use them are "nearly six times less likely to have a cyber incident" than those that do not.

The report calls that finding surprising, because until then the three controls most frequently recommended by insurers were endpoint detection and response, multi-factor authentication, and privileged access management. MFA registered when it was in place broadly, across all critical and sensitive data, all remote login access, and administrator account access, and those organizations were 1.4 times less likely to suffer a successful attack. Patching high-severity vulnerabilities within seven days of release ties as the fourth most effective control, halving the probability of a cyber event, and has the lowest implementation rate among the organizations studied at 24 percent.

Marsh is a broker, so it has an interest in insurable clients, and the research is its own; read it as informed and interested rather than neutral.

Underneath that sits a shorter, blunter list that shows up on almost every application:

• Multi-factor authentication with a defined scope.
• Endpoint detection and response.
• Backups that have been restored in a test.
• Privileged access controls.
• No unsupported end-of-life systems in production.
• A written incident response plan.

Most of it is public baseline guidance rather than an insurer invention. CISA's Cybersecurity Performance Goals 2.0 carries "Implement Multi-factor Authentication", "Administrators Maintain Separate User and Privileged Accounts", "Implement the Principles of Least Privilege", "Maintain System Backups and Restoration Ability" and "Manage Incident Response Plans" among its named goals. If you can answer those six accurately and favourably, most of the underwriting conversation is settled.

The claims data explains why carriers weight this set. Coalition's 2026 Cyber Claims Report reports that business email compromise and funds transfer fraud together accounted for 58 percent of cyber incidents in 2025, while ransomware was the most costly claim type at an average loss of $269,000, with dual extortion (encryption plus exfiltration) making up 70 percent of ransomware claims and initial ransom demands up 47 percent year over year. Coalition is an insurer publishing its own book, so the figures describe its policyholders rather than the whole market. The pattern still explains the questions: email compromise drives claim frequency, which is why the MFA and email security questions come first.

The five answers most companies get wrong

"Yes, we have MFA."

This is the big one, and it is the one that produced the Travelers matter. The question is almost never whether MFA exists somewhere. It asks about specific surfaces: email, remote access and VPN, privileged and administrative accounts, and sometimes servers and directory services individually. Most companies have MFA on email and their identity provider and something less than that on remote administrative access, legacy systems, and service accounts. Answer surface by surface.

"Yes, we have backups."

Configured is not tested, and the question increasingly asks about immutability, offline or segregated copies, and the date of the last successful restoration test. If you have never restored, say so, then go do a restore test before you submit, because it is the single cheapest thing on this list to fix.

"Yes, we have endpoint protection."

Traditional signature-based antivirus and endpoint detection and response are different products, and the application means the second one. If yours is antivirus, say antivirus.

"Yes, we have an incident response plan."

Applications now commonly ask when it was last tested or exercised. A document that has never been through a tabletop is a document. If you have not exercised it, the honest answer is that you have a plan and have not tested it, with a date for when you will.

"No end-of-life systems."

Almost nobody has none. There is usually a legacy server, an old operating system running a machine, or an unsupported database somewhere. Name it, say what compensating controls isolate it, and give a decommission date. A named and isolated exception is underwritable; an undisclosed one found during forensics is not.

How to write a partial answer

Carriers are not looking for perfection, and brokers will tell you the same. They are pricing risk, and a precisely described partial control is priceable. Three components make a partial answer work.

Scope. State exactly where the control is and is not enforced. "MFA is enforced for all users on email, the identity provider, and VPN. It is not yet enforced on three legacy administrative interfaces, listed in the attachment."

Compensating controls. Say what limits the exposure in the meantime. Network restriction, jump host, logging and alerting on those accounts, a small named user population.

A date. Commit to a completion date and then meet it, because the next renewal will ask. A missed commitment made in writing is worse than never having made one.

Give this to your broker before submission rather than after. A good broker will tell you which answers will cause a decline and which will merely affect price, and will sometimes tell you to delay the submission by six weeks and fix something first. That advice is usually correct and is why the broker relationship matters more in cyber than in most lines.

When insurance is the wrong next purchase

The part that costs us work, since we sell the program-building side of this.

If you cannot honestly answer yes to MFA on email and remote access, or you have never tested a restore, our recommendation is to close those before you buy a policy. They are cheap relative to a premium, they will lower the premium, and they remove the two gaps most likely to turn into the loss you are insuring against. Be clear about what the risk here is and is not: a missing control that you disclose accurately does not put the policy's formation in question. The carrier can price it, exclude it, or decline, and whichever it chooses you end up with a policy that means what it says. The formation problem is created by the answer, not by the gap, so if a contract deadline will not wait, disclose the gap precisely and buy the cover, then close the gap on the schedule you committed to.

If you are buying insurance instead of a security program because it looks cheaper, look again at the claims pattern. A policy pays some of the money back after an event that still costs you customers, weeks, and executive attention. It is a financial instrument, not a control, and no carrier claims otherwise.

And if a customer contract is what is forcing the purchase, read the contract before you buy, because required limits and required coverages vary widely and the wrong policy satisfies nobody.

Where Top Floor fits

Our vCISO practice handles insurance applications as a normal part of program work: mapping each question to the actual state of your environment, drafting partial answers that carry scope and dates, and prioritizing the controls that move both the premium and the risk. That work overlaps almost entirely with the first 90 days of any program build, which is why we cover it in what a vCISO should deliver in the first 90 days.

Where an incident is already underway, that is incident response and a different clock, and the first 24 hours after ransomware is the piece to read instead of this one.

How to decide this week

Pull last year's application and read your own answers as an adversary would. For each yes, write down what evidence you would produce if a forensic firm asked you to prove it, and mark every answer where the honest evidence is thinner than the answer implies. That list is your remediation queue and your disclosure list at once.

Then do the two cheapest fixes before renewal: run a restore test and document the result, and inventory every place administrative access can be obtained without MFA. Both are days of work, both change answers from qualified to clean, and both are things you would need anyway the first time anyone audits you.

Frequently asked questions

Can a cyber insurer void a policy over a wrong questionnaire answer?

Yes, if the misstatement is material to the risk the carrier priced. The remedies range from denying a specific claim to rescinding the policy entirely, which treats the contract as though it never existed and returns the premium. Travelers sought exactly that in 2022 against International Control Services over an alleged overstatement about multi-factor authentication deployment, and ICS agreed to a judgment rescinding the policy. Cyber applications are unusually checkable after a loss, because forensic investigation produces the evidence that shows what was actually deployed.

What controls do cyber insurers require in 2026?

Applications vary, but a consistent core appears on nearly all of them: multi-factor authentication with a defined scope covering email, remote access, and privileged accounts; endpoint detection and response rather than traditional antivirus; backups that have been restored in a test, ideally immutable or segregated; privileged access management; no unsupported end-of-life systems in production; and a written incident response plan that has been exercised. Marsh publishes a set of twelve key controls commonly required by carriers, and Marsh McLennan's research across those categories found automated hardening techniques the most effective at reducing the likelihood of an incident, ahead of the endpoint detection, multi-factor authentication, and privileged access management that insurers have historically recommended most.

Should I answer "partially" on a cyber insurance application?

Yes, when it is true, and write it properly. A usable partial answer has three parts: the exact scope where the control is and is not enforced, the compensating controls limiting the exposure in the meantime, and a committed completion date. Underwriters price partial controls all the time; what they cannot price is an overstatement, and an overstatement is the answer that fails when a claim triggers a forensic investigation. Share the draft with your broker before submission so they can tell you which answers affect price and which risk a decline.

Does having a vCISO help with cyber insurance?

Indirectly, and in two ways. Named security leadership appears on some applications and in some underwriting conversations, though it is rarely the deciding factor by itself. The larger effect is on the answers: the same inventory, access review, and baseline control work that a security program produces is what converts qualified application answers into clean ones. Buying a titled leader with no hours behind them to satisfy a questionnaire is the version that does not help, and it introduces exactly the kind of overstatement this article is about.