Cyber Insurance Requirements and Readiness: Build Your Carrier's Requirements Into Your Security Program

Insurers want proof, not promises

Carriers increasingly ask not only whether a control exists, but whether you can show it was in place and working. A questionnaire answered from memory, or a policy that says one thing while the environment does another, creates risk when a claim is filed. Readiness means your answers, your controls and your evidence match.

How BTI works with your carrier

1. Collect the requirements. We gather your application, renewal questionnaire and any security requirements from your carrier or broker, with your permission.
2. Communicate proactively. BTI communicates with your carrier to clarify requirements, rather than guessing at what a question means.
3. Map requirements to controls. Each requirement is matched to a control in your environment and an owner.
4. Close the gaps. Missing controls go on an itemized remediation plan you approve.
5. Write it into your program. Carrier requirements become part of your WISP, incident response plan, policies and evidence controls, so they are maintained, not remembered once a year.
6. Keep the evidence. Reports, logs, training records and test results are retained and ready for the next renewal or a claim.

Controls insurers commonly ask about

Every carrier's form is different. These controls come up often, and each links to where BTI delivers it:

• Multifactor authentication: Identity, MFA & Devices
• A written and tested incident response plan: WISP, IR Plans & GRC and tabletop exercises with your vCISO
• Remote access ports blocked at the firewall: Network Security & SASE
• Protected, encrypted backups kept separate from production: Backup & Disaster Recovery
• Email filtering and web security: Email Security & Awareness Training
• Removal of end-of-life systems and software, and patch management: Patch & Vulnerability Management
• Endpoint detection and response on all endpoints and servers: Endpoint Protection
• Logging across systems and perimeter devices: SIEM with optional one-year log retention on 24/7 MDR & Incident Response
• Security awareness training and phishing simulation
• Password managers and least-privilege access
• Vendor and supply chain risk management
• Independent testing: Essentials and Cyber Watch

Your WISP and incident response plan, built around your policy

Every BTI managed security client gets a written WISP and incident response plan, built from BTI's standardized framework based on ISO 27001 and tailored to your organization, as defined in your service agreement. Tailoring covers your industry, size, cyber insurance requirements, contractual requirements and liability exposure. When your carrier requires a specific notification step, retention period or control, it goes into the documents and the evidence controls that prove it.

If an incident happens

• For managed security clients, incident response is included in BTI managed security, as defined in your service agreement.
• Your incident response plan includes your carrier's notification steps.
• Cyber carriers often appoint the forensics firm. BTI assists during incident response by preserving log evidence, isolating affected systems and working alongside carrier-appointed digital forensics and incident response (DFIR) specialists. When your carrier does not appoint a firm, BTI can perform the forensic investigation. Forensic scope follows your service agreement.
• When an incident calls for on-site work, BTI staff respond in Los Angeles and Southern California, Chicagoland and Phoenix; elsewhere in the U.S., BTI coordinates on-site help through partners. Remote response is available wherever BTI supports you.
• Documentation of what happened, what was done and when supports your claim file.

Readiness review

Ask for a cyber insurance readiness review as part of your free assessment. Bring your latest application or renewal questionnaire. We compare your answers to your environment and give you an itemized gap list.