Cyber-insurance readiness check
Could you prove each answer on your cyber-insurance questionnaire?
Insurers ask about MFA, patching, access, backups, logging, malware protection, isolation and incident response. A “yes” you cannot evidence is worse than a documented gap, because it is the answer the claim is checked against. Tick only what you could show proof of today; the check scores it and lists what to close before the renewal.
Never send credentials, private keys, backup archives, or confidential source code through this website.
- Time
- Two minutes
- Basis
- The controls cyber-insurance questionnaires commonly ask about
- Privacy
- Runs in your browser; your answers are not sent
- Limits
- Not insurance or legal advice; every insurer’s wording differs
Tick what you could evidence today
Why evidence
The questionnaire is checked again when you claim
A cyber-insurance application is a set of statements the policy relies on. After an incident, the insurer’s investigators compare those statements with what they find. MFA that was on for the panel but not for three WordPress administrators, or backups that existed but had never been restored, are exactly the gaps that turn a claim into a dispute.
That is why this check asks what you could show rather than what you believe. Every control you cannot evidence today is either a task before renewal or an honest qualification on the form — both of which are better than a confident yes.
Common questions
Questions about the readiness check
Is this the same as my insurer’s questionnaire?
No. It covers the controls cyber-insurance questionnaires commonly ask about, phrased for a WordPress business. Your insurer’s wording, thresholds and exclusions are what count; use this to find gaps, then answer their form exactly as written.
What score do I need?
There is no pass mark — insurers weigh controls differently, and some, like MFA and tested backups, are commonly treated as conditions rather than points. The useful output is the list of controls you cannot yet evidence.
Who should fill it in?
Whoever would sign the application, together with whoever runs the hosting and the sites. The gaps usually sit between the two: the owner assumes the host does it, and the host’s contract says otherwise.
What does the audit cost?
A WordPress security audit is $150–$500 per site and takes two to four business days; a Linux server audit is $300–$750 per server. Each finding comes with the evidence an insurer can rely on.