What is an attestation letter, and what does it prove to a cyber insurer?

An attestation letter is a short signed statement from whoever facilitated your exercise, confirming that it happened: the date, the scenario, who took part, and that the person signing was independent of the response being tested. It is one page. It carries no findings and no score. It does not say you performed well, and it is not a certification of anything. What it does is turn your own account of an exercise into something a third party is willing to put their name to, which is the only part of an evidence file you cannot produce for yourself.

What does an attestation actually say?

Four things, and it is short enough that adding a fifth would weaken it.

That an exercise took place, on a stated date. That it followed a stated scenario. That named roles took part, usually listed by function and not by name. And that the facilitator was independent of the organisation’s incident response.

That is the whole document. It sits at the back of the after-action report instead of travelling on its own, because a confirmation that an exercise happened is not much use without the record of what happened in it.

What makes it an attestation and not a certificate?

The word carries a precise meaning in a neighbouring profession, and borrowing it loosely would be sloppy.

In the accounting profession, an attestation engagement is defined by the AICPA’s attestation standards, AT-C section 105, Concepts Common to All Attestation Engagements (AICPA, Attestation Standards, AT-C section 105, Concepts Common to All Attestation Engagements, 2023). The structure has three parts: an independent practitioner, subject matter that is somebody else’s responsibility, and criteria fixed in advance against which that subject matter is measured. The practitioner then reports their own conclusion. The international equivalent is ISAE 3000 (Revised), which covers assurance engagements other than audits of financial information.

Two things follow, and the second one matters more than the first.

An exercise attestation is not an AT-C engagement. We are not a public accounting firm and the letter does not claim to be an assurance report under any accounting standard. Anyone telling you their tabletop attestation is a formal attestation engagement is either confused or hoping you are.

What the letter does borrow is the structure, and the structure is what gives it force: somebody independent, describing something that is your responsibility, against criteria set before the exercise ran. Strip out the independence and you have a self-certification, which is the thing the question on the application was written to get past.

That distinction is the whole reason the document exists.

Who signs it, and why does that mirror the application?

Your side of the paperwork is already signed by an officer, which is easy to miss.

Cowbell’s application is signed by the undersigned authorized officer of the organisation, declaring the statements true, accurate and complete, and closing with Misrepresentation of any material fact in this Application may be grounds for the rescission of this Policy. (Cowbell Cyber Risk Insurance Application, Prime 250, 2020).

Beazley’s Canadian form is more specific about who that has to be. It requires the warranty to be signed and dated by member of the Control Group, which it defines as any principal, partner, corporate officer, director, Member, general counsel (or most senior legal counsel) or risk manager of the Insured Organisation (Beazley Cyber Application, Canada, 2026).

So a principal or an officer is personally putting their name to the testing answer, frequently without having seen any evidence behind it, because the technical answers came back from somebody else. The attestation is what that signature rests on. It is a small document doing a specific job: giving the person who signs the form something to point at.

How long does an attestation stay useful?

It does not expire, because it is not a licence. It records that something happened on a particular date, and that stays true for good.

What ages is its ability to answer the question in front of you. Beazley’s Canadian application asks whether the plan has been Tested in last year (Beazley Cyber Application, Canada, 2026), and that is a moving twelve-month window measured against the date on your letter. An attestation dated fourteen months ago is a perfectly truthful document that no longer ticks that box.

So the useful life of the letter is one renewal cycle, and the date on it is a choice, not something to accept whenever the calendar allows. An exercise run three months before renewal produces a letter that answers the question comfortably for the year ahead. One run immediately after a renewal is already eleven months old the next time anybody asks.

So schedule the exercise against your policy dates, not your quarter ends. It is the cheapest thing you can do to make the document work harder.

Is the attestation the same as the after-action report?

No, and confusing them leads people to buy the wrong thing.

The report is the substance: the scenario, who was in the room, the decisions they made, what worked, what did not, and recommendations with owners against them. It runs to eight sections. It is the document you actually learn from, and it is the one worth reading twice.

The attestation is one page at the back confirming that the exercise took place and who ran it.

Almost all the value to you is in the report. Most of the value to an underwriter is in the attestation. Keep that asymmetry in mind when somebody offers you an exercise with no written output, or a certificate with no exercise behind it. Each of those is half a product.

What an attestation is not

It is not a pass. There is no grade in it and no assessment of whether your response was good. A carrier reading it learns that the exercise was real, not that you did well.

It is not a certification, and nobody accredits it. There is no scheme, no registry and no logo.

It is not a guarantee of coverage or of a claim being paid. It supports one answer on one form.

And it is not the findings. This is where the two documents pull in opposite directions, and it is the most common misunderstanding after an exercise.

The exercises behind this template produce a recurring conversation once the report is drafted: clients ask for recommendations to be dropped or softened. The reason given is optics. The reason underneath is that nobody has yet decided to act on them.

The attestation is indifferent to that argument. It says the exercise happened, and it says the same thing whether the report contains four findings or none. So softening the findings does not improve the attestation. It leaves the attestation exactly as it was and makes the report thinner, which is the wrong end of the trade: a report with no findings reads as a demonstration rather than a test, and an underwriter who has seen a hundred of them notices.

Findings with an owner and a date against them make a stronger file than no findings at all.

Why can you not write it yourself?

Because the thing being asserted is that somebody outside your response watched it.

You can run the exercise. You can write the report, and a good internal team will write a better one than an outsider, because they know which decisions were genuinely hard. You can date it, file it and produce it on demand.

What you cannot do is be the independent party. That is not a comment on your integrity and it is not a rule anybody invented to sell services. It is the same reason a company does not audit its own accounts. A control that is only ever assessed by the people who operate it is the easiest one on any list to overstate, and everybody reading the form knows it.

That is why the testing line is on the application while a dozen other controls are taken on your word: the rest can be checked against a system if anybody bothers. This one can only be checked against a person.