Cyber insurance readiness

Cyber insurance readiness is the work of getting a business’s security controls in place and its evidence organized before it fills in a cyber insurance application or the questionnaire that comes back each year. It suits owners, CFOs, office managers and IT leads whose broker has just sent a form full of questions about multi factor authentication, backups and admin accounts and who want accurate answers they can stand behind. Canada Create is a Toronto agency that reviews those controls, closes gaps and assembles the evidence for businesses across Canada, working alongside the client’s licensed insurance broker. We do not sell, quote or place insurance and we never advise on coverage.

Contents

• Why the questionnaire arrives
• Controls insurers commonly ask about
• A gap review against your questionnaire
• Closing the gaps you choose to close
• Collecting evidence you can show
• An asset and system inventory
• Working alongside your licensed broker
• Answering every question accurately
• How this fits with your other security work
• Licensing and privacy rules to plan for
• How a readiness engagement runs
• What shapes the cost
• How to choose a partner for this work
• Your next step

Why the questionnaire arrives

Insurers price and accept cyber risk partly on how a business protects its systems, so most cyber applications include a security questionnaire. Many owners first see one when a broker suggests adding cyber coverage, when a large client asks for proof of insurance, or when the yearly questionnaire comes back longer and more detailed than last time. The questions are usually short, but each one asks about a specific setting or practice that someone in the business has to confirm.

Who usually ends up holding the form

In a smaller company, the form often lands on the owner or the office manager, who may not know whether the bookkeeper’s laptop has the same protection as the reception computer. In a mid sized firm, the CFO signs and the IT lead or an outside provider supplies the details. Either way, the person signing needs facts, not guesses, and the facts are spread across several people and systems.

What readiness means in practice

Readiness means three things are true before the form is signed: the controls the insurer asks about are in place or the gaps are known, the business can show evidence for each control, and the owner understands, from the broker, what each answer means for the application. Our part is the first two. The third belongs to the licensed broker.

Controls insurers commonly ask about

Every insurer writes its own questions, and the wording changes from year to year. Even so, many questionnaires return to the same group of controls. Knowing them in advance turns the form from a surprise into a checklist.

Multi factor authentication

Questions usually ask whether MFA is required on company email, on every way staff connect to office systems from outside, and on administrator accounts. Insurers often ask about each separately, so a business with MFA on email but not on its admin logins needs to say so plainly. Shared mailboxes, old service accounts and accounting software logins are common places where the second factor is missing.

Endpoint protection with detection and response

Many forms ask whether every computer and server runs endpoint protection, and some ask specifically about endpoint detection and response, known as EDR, which watches device behaviour and lets someone act on a suspicious machine. The honest answer depends on whether every device is actually covered, including the warehouse computer and the owner’s personal laptop used for work.

Backups kept separate and tested

Expect questions on how often data is backed up, whether at least one copy is kept separate from the main network with its own credentials, and when a restore was last tested. A backup that exists but has never been restored is weaker evidence than one with a dated test record.

Patching, admin rights and email filtering

Questionnaires often ask how quickly security updates are applied, whether staff work day to day without administrator rights, and whether incoming email is filtered for malicious links and attachments. Each of these is a setting or a record someone can show.

Training, written plans and vendor access

Other common questions cover whether staff receive security awareness training and how often, whether the business has a written plan for responding to a security event, and how access by vendors and outside support providers is controlled. The insurer may also ask about the types of data the business holds, such as health or payment information.

A gap review against your questionnaire

The most useful starting point is the actual questionnaire your broker sent, or last year’s if the new one has not arrived. We read it question by question and check each control against how your systems are really set up.

How the review is organized

Each question gets one of three findings: in place with evidence, partly in place, or not in place. Partly in place is the most common and the most important finding, because it covers cases like MFA on most mailboxes but not all, or backups that run nightly but have no separate copy. The review records exactly what is missing so the owner can decide what to do.

What the owner receives

The result is a readiness summary written for the person who will sign: each question, the current state in plain words, the gap if any, the effort to close it and the evidence that exists. It does not tell you how to answer the insurer, and it does not interpret coverage. It gives you, and your broker, an accurate picture to work from.

Scanning only with permission

Where the review includes any scanning of your systems, it is done only on systems you own or have written authorization to test, with that authorization signed before work starts.

Closing the gaps you choose to close

A gap review usually produces a short list of practical fixes. Some are small settings changes; others need planning with staff. The owner decides which to close before the application and which to schedule for later, after talking to the broker about how timing affects the application.

Typical fixes

• Turning on MFA for the remaining mailboxes, the accounting system and every admin account.
• Moving daily work off administrator accounts, including the owner’s.
• Extending endpoint protection to the devices that were missed and confirming each one reports in.
• Setting up a backup copy kept apart from the network, with separate credentials, and running a recorded restore.
• Putting security updates on a schedule with a record of what was applied.
• Reviewing which vendors can still sign in, and closing access nobody uses.
• Scheduling security awareness training and keeping attendance records.
• Writing the plan for handling a security event, with names and phone numbers.

Software in your name

Where a fix needs new software, such as endpoint protection or backup storage, the licence is bought in your company’s name, paid to the vendor and shown separately from our fees. You keep the consoles and the admin logins.

Collecting evidence you can show

Insurers may ask for proof of a control during the application, during the policy period or after a claim. Evidence collected at the time is far easier to produce than evidence reconstructed later.

What an evidence pack holds

• Written policies: acceptable use, passwords and MFA, backups, access for vendors and staff departures.
• Screenshots or exports of key settings, dated, such as MFA enforcement and email filtering rules.
• Endpoint coverage reports listing each device and its protection status.
• Backup job reports and the record of the most recent restore test.
• Patch status reports for servers and workstations.
• Training records showing who completed security awareness training and when.
• The written plan for a security event, with the date it was last reviewed.

Kept in one place you own

The evidence pack lives in a folder your company owns, organized in the same order as the questionnaire. When the next yearly form arrives, most of the work becomes updating dates and checking that nothing has drifted.

An asset and system inventory

Many questionnaire answers depend on knowing what you have. A business cannot honestly say every device has endpoint protection if nobody has a list of every device.

What the inventory lists

The inventory records computers, servers, phones used for work email, network equipment, cloud services that hold business data, and the accounts with administrator rights on each. It notes where sensitive data such as client files, payroll or health records is stored, and which vendors have access to which systems.

Where data lives

Some organizations prefer, or are required by clients or sector rules, to keep certain data in Canada. Major cloud providers, Microsoft among them, offer Canadian data centre regions. The inventory notes where each important system stores its data so the owner can answer questions about location accurately.

Working alongside your licensed broker

Cyber insurance is sold and explained by licensed insurance brokers and agents. They help you understand what each question means, how your answers affect the application and what the policy covers. That advice is theirs to give, and we stay out of it.

How the work divides

• Your broker explains the questions, coverage, policy wording, limits and the claims process.
• We review and improve the security controls and gather the evidence behind your answers.
• You, as the owner or signing officer, decide the answers with the facts in hand.

Sharing the readiness summary

With your permission, the readiness summary can go to your broker so they see where things stand before the application is submitted. If a question is unclear, the broker clarifies what the insurer means; we then check whether your setup meets that meaning. We do not contact insurers on your behalf and we do not compare insurers or policies.

Answering every question accurately

An insurance application is a statement of fact by the business, and its answers must be accurate. A yes given in good faith to a control that is only partly in place can create problems later. Readiness work exists to make sure the person signing knows the true state of each control.

When the honest answer is no

Sometimes a control cannot be fixed before the form is due. In that case the readiness summary records what is missing, what it would take to close it and any interim step already in place. How to present that on the application is a conversation for you and your broker.

Keeping answers true during the year

Controls drift. A new employee joins without MFA, a laptop is replaced and endpoint protection is not installed, a backup job fails quietly. A short check before the yearly questionnaire, or regular reporting through the year, keeps the answers you gave true.

How this fits with your other security work

Readiness pulls together controls that each have their own service. Our cyber security services page shows the full range. Device coverage is handled through endpoint security for every laptop and desktop, separate and tested copies through company data backup, staff sessions and records through security awareness training, and firewall and Wi-Fi settings through network security work.

If your concern is specifically ransomware, the ransomware protection page covers prevention layers and readiness planning for that threat. Where you want a scored view of your whole security posture beyond the questionnaire, a full security audit is the broader option, and many MFA questions are settled inside your tenant through Microsoft 365 support.

Licensing and privacy rules to plan for

Readiness work sits beside rules that apply to insurance and to the data a business holds. These are the general points we plan around.

• Only licensed insurance brokers and agents may sell insurance or advise on coverage. In Ontario, brokers are licensed by the Registered Insurance Brokers of Ontario (RIBO); other provinces have their own regulators.
• Answers on an insurance application must be accurate. Your broker and the insurer explain what each question means and how it affects coverage.
• Under PIPEDA, a breach of security safeguards that creates a real risk of significant harm must be reported to the federal Privacy Commissioner and to the people affected, and every breach must be recorded, which is one more reason insurers ask how you would notice one.
• In Quebec, Law 25 adds its own obligations for organizations that handle personal information.
• Health information custodians in Ontario follow PHIPA.

No readiness work can promise that an application will be accepted, that a premium will change or that a claim will be paid. This is a marketing observation, not legal advice.

How a readiness engagement runs

A free first conversation

We start with a call about the business: how many people and devices, where email and files live, who supports your systems today and what the insurer has asked. Send the questionnaire ahead if you have it, along with any answers given last year.

A written proposal

You receive a written proposal for the gap review, with fees quoted in writing and any written authorization for scanning set out clearly.

Review, fixes and evidence

The gap review produces the readiness summary. Where you want help closing gaps, each fix is scoped and quoted in writing before it starts. The evidence pack is built as each control is confirmed.

Ongoing reporting

Where ongoing work is agreed, a monthly note shows MFA coverage, device protection status, backup and restore results, training completion and any drift, so the next questionnaire starts from current facts.

What shapes the cost

Cyber insurance readiness work is quoted in writing after the free consultation. Security software, backup storage and other licences are paid to the vendor in your company’s name and shown separately from our fees. Insurance premiums are a matter between you, your broker and the insurer.

What drives the quote

• The length and detail of the questionnaire, and whether supplemental forms are involved.
• The number of users, devices, servers and offices in scope.
• How many cloud services hold business data and how their sign in settings are managed.
• Whether an up to date inventory exists or has to be built.
• How many gaps you ask us to close, and how much staff coordination each needs.
• Whether the engagement is a one time review or includes ongoing reporting through the year.

A small dental office with cloud email and a handful of workstations faces a short form and a modest review; an engineering firm with two offices, project servers and several outside consultants signing in faces a longer one.

How to choose a partner for this work

The firm that prepares your readiness evidence will see how your systems are put together, and its findings shape answers you sign. Ask these questions before work starts:

• Who owns the accounts? The answer should be you, including security consoles, backup storage, admin logins and the evidence folder.
• Will you work from the insurer’s actual questionnaire, question by question?
• Will the readiness summary tell me plainly where the answer is no or partly?
• Do you stay out of coverage advice and leave it to my licensed broker?
• How do you handle written authorization before any scanning?
• Will the evidence pack be organized so I can update it myself next year?

Signs of a weak answer

Be careful with any provider who offers to tell you how to answer so the form looks better, suggests a particular insurer, promises approval or premium changes, or keeps the evidence and admin logins in its own name. Plain, accurate and in your name is the standard to expect.

Your next step

Before the call, gather the questionnaire your broker sent, last year’s answers if any, a rough count of computers and servers, and the name of whoever manages your email and backups. With that, Canada Create can walk through each question in a free readiness review and send a written proposal afterward.

Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning.

You can also send your questionnaire for a readiness review. We reply within one business day.

Our office is at 126 Willowdale Avenue, Suite 3, Toronto, and we work with businesses across Canada.