You checked ‘Yes.’ Can you prove it?

Every year around renewal time, someone in your office gets a questionnaire from your insurance broker. It asks things such as: Do you require multi-factor authentication (MFA) for all remote access? Are your backups stored offline and tested? Is endpoint protection running on every device? And every year, somebody checks “yes,” signs it, and sends it back. Usually it’s the owner, the office manager, the CFO or even the IT person, answering with the best of intentions. Almost nobody goes and verifies. Here’s the problem. That questionnaire isn’t a survey. It’s the foundation your policy is built on. Insurers decide whether to cover you, and what to charge, based on what you tell them. If what you told them turns out not to be true, they may not have to pay.

The case every business owner should know In April 2022, an Illinois electronics manufacturer—International Control Services—bought a $1 million cyber policy from Travelers. Its application, signed by the CEO, said the company used multi-factor authentication to protect administrative and privileged access. The next month, ransomware hit. When Travelers investigated, it found MFA protecting exactly one thing: the company’s firewall. The servers the attackers went after had none. Travelers didn’t just deny the claim. It went to federal court and asked a judge to rescind the policy entirely, treating it as if it had never existed. By the end of that summer, the company agreed to the rescission. A million dollars of coverage, gone, over a checkbox. It wasn’t a one-off. In 2025, taxpayers in Hamilton, Ontario (Canada) were left holding the bill for a ransomware attack that cost the city more than C$18 million after its insurer denied the claim. The attack started on an internet-facing server without MFA. The pattern is consistent enough that insurers talk about it openly. Coalition, one of the larger cyber insurers, reported that 82 percent of denied claims involved organizations without fully deployed MFA.

Nobody lied. That’s what makes it dangerous. Most of these situations don’t involve anyone trying to commit fraud. They involve a gap between what the owner believes is in place and what is actually configured. You turned on MFA for email three years ago, so you answer yes. But the remote access tool your bookkeeper uses doesn’t require it. Neither does the administrator account your previous IT provider set up. Neither does the service account that runs the file server. You pay for backups, so you answer yes. But nobody has tried a full restore since the system was installed, and the backup drive is plugged into the same network the ransomware will encrypt. You have antivirus, so you check the box for endpoint protection. But two laptops dropped off the management console months ago and nobody noticed. Every one of those answers was given in good faith. Every one of them can still sink a claim. After a breach, a forensic team will compare your network against your application, question by question, and any difference becomes the insurer’s argument.

What to do before your next renewal Pull last year’s application. Most owners haven’t looked at it since they signed it. Read every question you answered “yes” and write down what you would show an investigator to prove it. If you can’t think of anything, that’s your to-do list. Answer narrowly and honestly. “MFA on all remote access” means all of it: vendors, contractors, old accounts and the tools your IT provider uses to get in. If the true answer is “mostly,” say so and explain your plan. A higher premium is far cheaper than a voided policy. Get evidence, not assurances. Ask your IT provider for reports or screenshots showing MFA enforcement, backup restore tests and which devices are actually protected. If they can’t produce it within a few days, that tells you something. Test your backups. Restore a real system, time how long it takes and write down the result. A backup you’ve never restored is a hope, not a control. Treat it like a financial statement. You wouldn’t sign a loan application full of guesses. Have someone who understands the technology review the answers before you sign. Re-check midyear. Most policies expect you to maintain these controls the whole term, not just on the day you applied. New hires, new software and a new IT vendor can quietly undo what was true in January.

Build it once, use it twice. Earlier this year, I wrote in these pages about Texas Senate Bill 2610, which protects businesses with fewer than 250 employees from punitive damages after a breach if they can show a documented cybersecurity program was in place. The same records that help you in a courtroom help you with your insurer. Policies, configuration reports, restore tests and training logs do double duty. Cyber insurance is still one of the smartest purchases a small business can make. But a policy only protects you if the facts it was built on are true when you need it. Spend an hour before renewal finding out whether yours are.