Governance · Technology due diligence · 03
Cyber insurance evidence preparation
Cyber insurance evidence preparation assembles and verifies the controls evidence that underwriters now require for an application or renewal, so that answers are accurate, supported and consistent with what an underwriter’s own scan or a post-incident review would find. It is needed when an application asks detailed questions about MFA, endpoint detection, backups, privileged access and incident response, when a renewal has brought new requirements or higher premiums, when a prior application was answered optimistically, or when a claim could be contested on the basis of an inaccurate answer. The preparation produces verified answers with evidence for each question, the gaps between what the insurer expects and what exists, the remediation that affects premium or insurability, and the pack that supports both the application and any future claim.
Scope
What the review covers.
- Application and renewal questions mapped to controls
- Verification of each control claimed: MFA, endpoint detection, backups, privileged access, patching, training, response plan
- Gap identification against underwriter expectations
- Remediation that affects insurability and premium
- Consistency check against external scan results
- Evidence pack supporting the application and future claims
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Verified application answers | Each with evidence references |
| Gap and remediation list | What underwriters expect that is missing |
| Evidence pack | For the broker, the insurer and any claim |
| Renewal readiness plan | What to maintain for next year |
Prerequisites
What we need from you.
- The application or renewal questionnaire and the broker’s guidance
- Access to the systems that implement the controls claimed
- Previous applications and policy terms
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Why does accuracy matter so much?
Insurers have contested claims where applications overstated controls. Accurate, evidenced answers protect the policy as well as the premium.
Can this reduce our premium?
We make no premium claims. Insurers price controls; demonstrated controls are priced differently from claimed ones.
Does this overlap with ransomware readiness?
Substantially. Insurers ask ransomware questions above all. See Ransomware readiness review.