Free questionnaire review
Help with your cyber-insurance application.
Obsidian Ridge offers a free, one-off cyber-insurance questionnaire review for small businesses. Email your carrier's questionnaire to security@obsidianridge.io; our CISSP-led practice replies within one business day, serving the Research Triangle and businesses across the United States. We are not an insurance agent or broker.
Published . Updated . By Kfir Yair, CISSP.
How does the free review work?
Email the carrier's questionnaire and your renewal date. Point out the questions you cannot confidently answer. We explain the security terminology, identify the evidence to look for and flag controls that need checking. You retain responsibility for the answers you submit.
The reply is due within one business day. That is a response commitment, not a promise to finish remediation or obtain insurance in a day. Download the cyber-insurance application checklist PDF and use the questionnaire worksheet to prepare.
Which controls should we check against the application?
Start with the questions on your own form. The examples below help separate control evidence from a product purchase; they do not assert that every carrier has identical requirements.
| Control | Evidence to look for | Obsidian Ridge scope and price |
|---|---|---|
| MFA and account access | Settings and coverage for staff, administrators and relevant remote access | ITDR monitors accounts; it is not proof MFA is configured. Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. |
| Endpoint EDR/MDR | Supported device inventory, deployment records and named response responsibility | MDR: Ridge Watch business MDR costs $15 per device per month, month-to-month with no minimum, plus business onboarding. Core adds ITDR at its person-based rate above. |
| Backups | Backup coverage and a dated restore-test result | Managed backup is not sold in any tier. The Sprint can check the evidence; your backup/IT provider owns operation and restoration. |
| Staff training | Assignment dates, completion records and simulation follow-up | Managed SAT: Ridge Plus costs $50 per person per month on an annual term, billed monthly, with no minimum. It adds staff training, email-security configuration and a secure browser to Ridge Core; business onboarding is separate. Training is not sold standalone. |
| Patching | Inventory, patch status and documented exceptions | Ridge Reserve costs $70 per person per month on an annual term, billed monthly, with no minimum and onboarding separate. It adds an incident-response plan and annual tabletop, quarterly admin-access review, monthly patch reporting and an annual questionnaire refresh to Ridge Plus. Clinical software and IT responsibilities must still be agreed. |
Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. Business onboarding is separate: $500 for up to 25 machines, or $1,000 for 26 to 100. See pricing before treating a recurring rate as the whole engagement fee.
When is the paid Sprint useful?
The Readiness Sprint costs $1,500 to $3,500 once for a 7-business-day engagement. The deliverable is the same at each scope: a signed evidence pack and a record of controls and gaps. The Cyber Insurance Readiness Sprint is for the separately scoped evidence and gap work beyond the free review. Price follows environment size and complexity, not a different promised deliverable. It is not credited against the monthly subscription.
The guarantee concerns delivery of the evidence pack: if it is unfinished, we keep working at no additional charge until it is delivered. It does not guarantee coverage, a premium or an underwriting result.
What should stay with the practice and broker?
The practice confirms that its answers are accurate, including partial deployment and exceptions. Its IT provider supplies records for systems it operates. Its broker and carrier answer coverage and policy questions. Obsidian Ridge explains the security controls we review and operate.
For specific buying questions, read the dental renewal checklist, CPA WISP guide, or small law-firm guide.
Sources and scope
- Published pricing and service boundaries: current monthly rates, terms and response responsibilities.
- Questionnaire worksheet and its source list: the existing control checklist and carrier-form references.
- Readiness Sprint: paid engagement and deliverable.
Questions about the free review
Who can help a small business fill out a cyber-insurance application?
Obsidian Ridge offers a free, one-off cyber-insurance questionnaire review for small businesses.
Email your carrier's questionnaire to security@obsidianridge.io; our CISSP-led practice replies within one business day, serving the Research Triangle and businesses across the United States. We are not an insurance agent or broker.
We explain security controls and evidence; your business owns its answers and your broker or carrier handles coverage decisions.
Is the questionnaire review really free?
Yes. The one-off questionnaire review is free. It is not a deployment, a completed risk assessment or a signed evidence pack. Any paid work is separately scoped before you agree to it.
What should I send and when will you reply?
Email your carrier's questionnaire to security@obsidianridge.io and include the renewal date and any questions you are unsure about. We reply within one business day. Do not email passwords, recovery codes, patient files or client records; the questionnaire and your questions are enough to start.
Can you guarantee that the insurer will accept my application?
No. We are not an insurance agent or broker. We help explain your controls and supporting evidence; the carrier decides eligibility, coverage, terms and premium. Do not claim a control is operating until it is.