Cyber insurance questionnaire and application: the 2026 worksheet.

A cyber insurance questionnaire is the 20-to-40-question application a carrier uses to underwrite a policy.

It asks what security controls you operate (MFA, EDR/MDR, backups, incident response, and about a dozen others), quantifies your revenue and record volumes, and drives eligibility, price, sublimits, and whether a future claim actually pays.

The 2026 cyber insurance application is the same instrument as the questionnaire: a written attestation of your security posture that the carrier binds coverage against.

What changed after 2021 is that the answers became controls-warranty language: a misrepresented control, such as MFA scope, can let a carrier rescind the policy or deny a ransomware claim.

Ten controls show up on every U.S. SMB cyber application we have reviewed across seven carriers: MFA on email and remote access and admin accounts, EDR or MDR on workstations and servers, immutable or MFA-locked backups with tested restores, privileged access separation, email gateway with sandboxing, patch and EOL management, a written and tested incident response plan, no flat networks or exposed RDP, funds-transfer verification, and security awareness training with phishing simulations.

In the SMB market, a cyber insurance audit is either the application itself (self-attested), a carrier-commissioned scan of your external attack surface run before binding, or a post-loss forensic review that reconciles what you said on the application with what the environment actually showed.

All three come back to whether the answers on the application were true.

The quiet declines: MFA on email but not on VPN or admin accounts; EDR on laptops but not on servers; nightly backups that have never been restored; no written incident response plan; internet-facing end-of-life software; RDP open on port 3389; no out-of-band verification on wires above a stated threshold (commonly $25,000).

Any one of these can also become the reason a paid policy does not pay after a loss.

Walk each question in order and answer honestly with evidence you can produce: an MFA coverage report from your identity provider, an EDR coverage list from your endpoint console, restore-test logs with a date and an initials block, the current incident response plan file, a vendor inventory, and the training completion report.

If a control is only partially deployed, disclose the scope and accept the pricing. Both are safer than a yes you cannot evidence.

A policy can be rescinded, denied, or voided from inception when a material misstatement on the application is discovered, typically after a loss.

In 2022 Travelers filed to rescind a cyber policy against an Illinois control-systems manufacturer that had attested to multifactor authentication across its digital assets when MFA protected only the firewall.

After a ransomware loss, the parties agreed to a judgment rescinding the policy from inception (source: Travelers Property Casualty Co. of America v. International Control Services, Inc., C.D. Ill. No. 22-cv-2145).

Obsidian Ridge reviews your cyber-insurance questionnaire before you submit it, free and with no obligation, and replies within one business day. You answer and sign the application; we review the security questions.

Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.

Close gaps against the 10 controls before renewal, and describe them in the exact language the carrier will use on the form.

Documented restore tests, MFA on every admin account, an operating EDR with named monitoring, and a written IR plan reviewed in the last 12 months give your broker a stronger submission to take to market.