The insurance renewal questionnaire
A client forwards their cyber insurance renewal questionnaire with a one-line note: please fill this in, it's due Friday. Forty questions on MFA, backups, admin accounts and incident response, and the client has no idea which answers are true. They assume you do, and they assume the answers are mostly yes.
Most MSPs treat it as admin. It is a list of every gap the insurer cares about, written by the people who set the client's premium. Every "partially" is a conversation the client is already primed to have, in the one month of the year they are thinking about risk and cost in the same breath.
Gather first: the questionnaire and your current record of the client's controls.
The prompt:
Help me answer a client's cyber insurance renewal questionnaire honestly and turn the gaps into a short case for fixing them before renewal.
What an experienced reviewer knows about these forms:
Insurers weigh a few controls far more than the rest: MFA on email, remote access and admin accounts, endpoint detection and response, backups that are offline or immutable and tested, and a written incident response plan.
A "yes" that is only partly true is the expensive mistake. If a claim shows the control was not in place, the insurer has grounds to reduce or refuse the payout.
"Partially" is often the most accurate answer, and it needs a one-line explanation and a date.
The questionnaire: [paste the questions]
What we know about the client's environment: [current controls, and how we know each one]
Renewal date and current premium, if shared: [details]
Who will read the note: [client owner, finance lead or other]
Do this:
For each question, give the honest answer (Yes, No or Partially), the evidence we hold, and any wording the insurer might read more broadly than we intend.
Rank the gaps by how much they are likely to matter to the insurer. For the top three, say what closing each one involves in effort and time.
Write a one-page note for the reader above in plain business language, covering the three gaps, what each one risks at claim time and the decision we need from them.
Where our evidence is missing or unclear, list it as a question for me instead of assuming the control exists.