Home›Insights›Compliance

How to Pass Your Cyber Insurance Questionnaire in 2026

Cyber insurance questionnaires used to be a checkbox exercise. Now they decide whether you get a quote at all. Here's what they're really asking and what to do before your next renewal.

Compliance 2026-05-12 10 min read

Cyber insurance questionnaires used to be a checkbox exercise. Now they decide whether you get a quote at all. Here's what they're really asking and what to do before your next renewal.

Why questionnaires got harder

Cyber claim frequency and severity climbed sharply between 2021 and 2025. Carriers have repriced and tightened underwriting. The questionnaire is now the underwriter's first filter. Weak answers mean higher premium, lower limit, or no quote at all.

MFA on everything

The number one question is whether you have multi-factor authentication on all administrative access and all remote access. Note 'all'. If your admins still log into the firewall with a username and password, the answer is no. Fix this first, every time.

Tested backups

Carriers ask whether you have tested, offline or immutable backups. 'We have backups' is not the answer they want. They want to know that you've actually restored from them recently, that the immutable tier exists, and that the retention covers the time it would take to detect ransomware.

EDR deployed everywhere

Endpoint detection and response on every laptop and server, not just file servers. Brand matters less than coverage. If you have EDR on 95% of endpoints but the office manager's home laptop is exempt, count yourself as not fully covered.

Incident response plan

Carriers want a documented IR plan and named external IR partner. Not aspirational. Documented. The retainer-style relationships some MSPs and law firms offer now exist specifically because of this question.

Training and phishing simulation

Annual training plus regular phishing simulation. 'Annual training' alone is now considered weak. Quarterly simulation with click-and-train flows is the new bar.

How to triage before renewal

Sixty days before renewal, walk the questionnaire and rate every answer Honest Yes, Soft Yes, Soft No, Honest No. Anything that isn't Honest Yes is a project. Soft Yes answers turn into Honest No when the carrier audits a claim, which is when it actually matters.

Want this in your inbox?

We send a short monthly note with one cybersecurity or IT topic that BC business owners should know about. No sales pitch.

Get the monthly note Read more Insights

Related work

Services mentioned in this post.

Talk to us about your project

Frequently asked questions

Why is the cyber insurance questionnaire getting harder to pass?

Rising ransomware attacks globally have forced insurance providers to change their behaviour. Insurers now require objective proof of proactive defence mechanisms like MFA, dark web monitoring, and immutable backups to lower their risk exposure for businesses in regions like Alberta, BC, and the Yukon. Without these, your firm is considered a high liability.

Do I need EDR to pass a cyber insurance audit in 2026?

Yes, most modern insurers now mandate Endpoint Detection and Response (EDR) as a baseline requirement. EDR provides real-time monitoring and automated response capabilities that traditional antivirus software lacks. Demonstrating that you have active EDR on all workstations and servers makes your business a significantly lower risk for underwriters.

What role does MFA play in insurance eligibility?

Multi-Factor Authentication is currently non-negotiable for most 2026 policies. You must prove it is active on all remote access points, administrative accounts, and cloud email logins to qualify for competitive premiums. If MFA is not enforced across your entire organization, you risk immediate denial of your insurance application.

Can Northstar IT help me fill out my insurance form?

We provide comprehensive technical assessments that align directly with questionnaire requirements. Our team helps you implement and document the necessary security controls, such as security awareness training and networking infrastructure upgrades, to ensure your answers are accurate and verifiable during an audit by the insurance provider.

Are small businesses in BC and Alberta targets for cyber attacks?

Absolutely. Firms in smaller centres like Smithers, Terrace, or Williams Lake are often targeted because attackers assume they lack robust defences. Insurers recognize this trend and apply the same rigorous standards to small businesses as they do to mid-market firms, requiring a high level of cybersecurity maturity regardless of location.