The cyber insurance application looks like paperwork, and it reads like a security audit. Every checkbox is a statement about your controls, and the carrier relies on those statements when a claim comes in.
This walkthrough follows the order of real forms, the Corvus Smart Cyber Insurance Application (version 3.2, September 2024) and Beazley's Ransomware Supplemental Application. For which controls insurers require in the first place, see cyber insurance requirements.
What this guide solves: It turns a 20 to 50 question form into owned sections, evidence to collect and answers you can defend. The goal is a submission that survives both underwriting and a post-breach review.
What's on a Cyber Insurance Application?
Most submissions have three layers. A base application, one or more supplementals, and a signed declaration. The base application covers your business and core controls. Supplementals go deeper on one risk, most often ransomware. The declaration is where an officer attests that everything above it is true.
The table shows what each section of the two sample forms covers.
Section | What it asks | Corvus | Beazley ransomware supplemental |
|---|---|---|---|
Company profile | Revenue, subsidiaries, industry, websites | Q1 to Q6 | Not covered |
Data held | Number of PII records, including records held by vendors, and biometric data | Q7, Q8 | Not covered |
Security budget and staff | IT budget, security share, headcount, CISO contact | Not covered | Q1 to Q3 |
Email security | Filtering, sandboxing, SPF, DKIM, DMARC, macros, legacy protocols | Q9 | Q4, Q7 to Q9 |
Identity and MFA | MFA scope, privileged accounts, password managers, service accounts | Q11, Q12 | Q10 to Q15, Q20 to Q26 |
Endpoint and network | EDR/MDR/XDR vendor, SOC, protective DNS, firewall defaults, RDP, SMB | Q13, Q16 | Q27 to Q32 |
Vulnerability management | Asset inventory, end-of-life software, scanning, patch speed, penetration testing | Q17 | Q16 to Q19, Q33 to Q37 |
Backups and recovery | Offline, immutable and encrypted copies, restore testing, BCP/DR plans | Q10, Q15 | Q38 to Q46 |
Fraud and payments | Out-of-band verification of payment changes, PCI compliance | Q19, Q21 | Not covered |
Loss history | Incidents in the past three years, known circumstances, outages over six hours | Q22 to Q24 | Not covered |
The two forms overlap on identity, backups and testing. Those are the sections every carrier asks about in some form.
Who Should Fill Out the Application?
Treat the form as a cross-functional document with one accountable owner. The broker sends it, but the answers belong to the people who run each control.
Split it like this:
Finance or risk manager: company profile, revenue, prior policies and loss history.
IT or infrastructure lead: email, endpoint, network, backups and recovery.
Identity owner: MFA scope, privileged accounts and service accounts.
Security lead: scanning, patch timelines, penetration testing and incident response.
Signing officer: final review of every answer before signature.
The signature carries weight. The AXIS ransomware supplemental must be signed by an officer such as the CEO, CIO, CTO, CSO, CFO or general counsel.
How to Answer the Cyber Insurance Application Questions
Each section below covers what the carrier is really checking, what evidence to pull, and where answers go wrong.
Company Profile and Data Volume
Corvus asks for the number of personally identifiable records you store, process or transmit, in bands that start at 0 to 250,000 and run above 10 million. The count explicitly includes records held by third-party providers.
Pull the count from your CRM, data warehouse and every SaaS vendor that holds customer data. Undercounting here quietly lowers the limit the carrier thinks you need, which shows up at claim time. Corvus also asks whether you collect biometric data, including fitness and health data. Check with product teams, since health and fitness features often collect it.
Email Security
Email gets detailed questions for a reason. The FBI's 2025 IC3 annual report recorded $3.05 billion in business email compromise losses from 24,768 complaints, up from $2.77 billion in 2024. Carrier claims data points the same way. Coalition's 2026 Cyber Claims Report found that business email compromise and funds transfer fraud made up 58% of its claims.
Beazley asks which inbound controls you run: attachment and link screening, sandboxing, external email tagging, SPF, DKIM and DMARC. It also asks whether legacy protocols such as IMAP, POP3 and basic-auth SMTP are disabled.
Answer DMARC from your DNS record, not from memory. A policy of p=none monitors mail but blocks nothing, so say which policy you enforce.
Multi-Factor Authentication
MFA questions are split by scope, and each scope is a separate answer. Corvus asks about four: remote network access, privileged accounts, email on all devices, and all critical applications.
Beazley adds domain administrator accounts and remote desktop tools, and handles service accounts in their own section. Its definition of MFA includes SMS, push notifications, authenticator apps and FIDO2 keys.
Carriers accept SMS and push as MFA. CISA's phishing-resistant MFA guidance warns that those methods can fall to phishing, push bombing and SIM swaps, and recommends FIDO or PKI-based methods. Export an MFA coverage report from your identity provider before answering. Every exception, such as a legacy app or a break-glass account, goes in the free-text section.
Privileged Access and Service Accounts
Beazley spends seven questions on service accounts with domain admin rights. It asks how many exist, whether they follow least privilege, whether interactive logins are denied, and whether passwords are at least 25 characters or randomly generated.
The first question usually needs a query to answer. Pull the list from Active Directory or your cloud identity provider, since "we think about five" isn't an answer an underwriter can price. These accounts matter because attackers use them to spread. See how privilege escalation and lateral movement turn one foothold into a network-wide incident.
Endpoint, Network and Monitoring
Both forms ask which endpoint tools you run and want the vendor named. Beazley also asks whether you have a security operations center, whether it runs 24/7, and whether it can isolate endpoints remotely.
The network questions are specific. Beazley asks about protective DNS, default-deny firewalls, blocking inbound SMB, and whether RDP or tools like AnyDesk and TeamViewer are exposed to the internet. Answer the exposure questions from an outside view of your network. An external penetration test shows what's reachable before the carrier's own scan does.
Vulnerability Management and Penetration Testing
Beazley asks what share of your estate is scanned, how often, and how long you take to fix critical CVEs, with options from over two weeks down to under 48 hours. It then asks how often you, or a third party, run penetration tests.
Corvus asks a single question here, whether you conduct penetration testing of your network at least annually. Its glossary describes a penetration test as a simulated attack, typically performed by an authorized third party. Keep scanning answers and pentest answers separate, since the forms treat them as different controls. VAPT explained covers the distinction, and CVSS, EPSS and CISA KEV helps you defend your patch timelines.
For a quarterly answer on the testing question, you need testing you can rerun on demand. CodeAnt AI's penetration testing runs black box, white box and gray box tests and delivers an audit-grade report within 48 hours.
Backups and Recovery
Backup questions are the most granular on the Beazley form. It asks whether backups sit on your corporate network, whether a cloud backup is really a syncing service like OneDrive or Dropbox, and how long a full restore from the cloud would take.
It then asks about offline copies, encryption, whether decryption keys are kept offline, immutability, restore testing frequency and malware checks before restore. Corvus adds backup segmentation, unique credentials and MFA on backup access. A synced folder is the answer most likely to be wrong. File sync replicates deletions and encrypted files, so ransomware that hits the laptop hits the "backup" a few seconds later.
The FBI's own ransomware guidance in the IC3 report lines up with these questions. It recommends offline, encrypted and immutable backups that cover the whole organization.
Fraud and Payment Controls
Corvus asks whether you verify payment and bank-detail change requests with the requester through a separate channel before sending money. That's out-of-band verification, such as calling a known number.
This question exists because of loss data. Coalition's 2026 report found that 71% of funds transfer fraud claims came directly from social engineering. Write the procedure down and name who owns it. A verbal "we always call" won't hold up after a wire goes out.
Loss History and Known Circumstances
Corvus asks about any cyber, privacy or media incident in the past three years, and any known circumstance likely to lead to a claim. It also asks about unscheduled outages longer than six hours.
Disclose incidents with what changed afterward. An incident you disclosed and fixed is an underwriting conversation, while one the carrier discovers later becomes a rescission argument, as the Travelers case in our cyber insurance requirements guide shows.
PCI Compliance
If you accept payment cards, Corvus asks whether you or your payment processor are PCI compliant. Outsourcing card processing changes your scope, but it doesn't remove your obligations.
Our guide to PCI DSS penetration testing requirements covers what testing PCI DSS v4.0 expects.
The Answers That Cause the Most Trouble
A few questions look simple and hide conditional answers. The table shows how to answer them honestly.
Question | Risky answer | Accurate answer |
|---|---|---|
MFA on all remote access | "Yes" because VPN has MFA | Yes for VPN, list RDP jump hosts or vendor access without MFA as exceptions |
MFA on email | "Yes" because the Outlook app prompts | Confirm legacy protocols are off, since IMAP and POP bypass MFA |
Offline or air-gapped backups | "Yes" because files are in the cloud | Yes only for copies that can't be reached with production credentials |
EDR in place | "Yes" with partial deployment | State coverage as a percentage and list uncovered systems |
End-of-life software | "No" without checking | Run an asset inventory first, then answer |
Penetration testing annually | "Yes" based on a vulnerability scan | Answer the scanning questions for the scan, and answer yes here only for a real pentest |
Critical CVE remediation time | The target in your policy | The actual median from your ticketing data |
The pattern is the same in every row. Answer with what's deployed and measured, and put the nuance in the free-text box.
Cyber Insurance Checklist Before You Submit
Run this checklist two to four weeks before the application is due. Each item is evidence you should be able to produce within an hour of a carrier asking.
Identity
MFA coverage report: exported from your identity provider, with every exception listed.
Service account inventory: accounts with domain admin rights, owners and password policy.
Email and fraud
DNS records: SPF, DKIM and the DMARC policy you actually enforce.
Payment verification procedure: written, with a named owner.
Endpoints and network
EDR coverage: percentage of endpoints and servers, and the vendor.
External exposure: results from an external test covering RDP, VPN and exposed services.
Backups
Architecture note: which copies are offline, immutable and encrypted.
Restore test log: date and result of the most recent full restore.
Testing and patching
Penetration test report: executive summary, scope, date and retest results for critical and high findings.
Patch metrics: median time to remediate critical CVEs over the last 12 months.
Governance
Incident history: past three years, with the fix for each.
Signed review: each section owner confirms their answers in writing before the officer signs.
What Happens After You Submit
Underwriting doesn't stop at your answers. Corvus states on its form that it scans the applicant's primary website and affiliated sites and includes the results in the quote.
Expect follow-up questions on anything partial, and answer them in writing. Beazley's form also requires you to tell the insurer if anything changes between signing and the policy's start date. Keep the evidence package dated and filed with the signed application. If a claim comes in, that folder is how you show the answers were true on the day you signed.
Where This Leaves You
The cyber insurance application rewards teams that answer from evidence. Split the form by owner, pull the reports before you answer, and put every exception in writing.
Start with the controls carriers weigh most, covered in cyber insurance requirements, then use the checklist above to close gaps before you sign.
