Our cyber insurance came up for renewal last November. Three years ago the proposal form was a single page with twelve questions and our broker filled most of it in for us. This time it ran to a hundred and forty questions across nine sections, required documentary evidence for six of them, and made the quotation conditional on letting the insurer scan everything of ours that faces the internet.
Answering it honestly took my team eleven working days. Four answers we could not give as the question was worded. Multi factor authentication on all remote access, except one legacy connection used by a maintenance supplier and forty one of our own people. Privileged accounts separated from daily accounts, mostly. Backups held offline or immutable, one copy of three. Endpoint detection on every server, apart from six too old to run the agent and too embedded in a process to replace.
The commercial reply was a premium up by not quite half, an excess doubled, a sub limit on one category and two conditions precedent, which is the clause that makes cover void for an event if the control we named was absent when it happened. An optimistic answer on a form stops being a small embarrassment and becomes the reason a claim fails.
So we did fourteen weeks of work against somebody else's deadline. The supplier connection was retired, the six servers were replaced, the third copy of the backups moved offline, and privileged accounts were separated properly rather than mostly. Every item of it was worth doing. What struck me afterwards was that the order we did it in was not an order I had chosen.
The part I sit uneasily with is whose list it was. An insurer's questions are shaped by claims data, which means they describe what has already cost somebody money. Nothing on that form asked about the control systems in our depots, or our dependence on one logistics platform, or what we would do if a single supplier were unavailable for a fortnight, and those are the three things I actually lose sleep over.
Every question now has a named owner and evidence attached, and the declaration is signed by someone who can be shown proof. My own register sits beside it, and I still have to fight for the items on it.
– Serguey Shinder
