How do you answer the incident response testing question on a cyber insurance application?

Answer it the way you can evidence it. If you ran an exercise inside the last twelve months and you hold a dated record naming the scenario, the people in the room and what it found, answer yes and keep that record with the application file. If you cannot produce that record, an unprovable yes is the worst of your three options. The reason is on the form itself: an officer of your company signs the application, and the declaration above the signature says the statements in it are true, accurate and complete.

What does the question actually say?

There is no standard cyber application. The first step is working out which version of the question you have been handed, and four published examples show the range.

The most demanding one in wide circulation is Cowbell’s Prime 250 application:

Does the organization have an incident response plan - tested and in-effect - setting forth specific action items and responsibilities for relevant parties in the event of a cyber incident or data breach matter?

It is question 7 on the full application and question 4 on the renewal form, with identical wording on both (Cowbell Cyber Risk Insurance Renewal Application, Prime 250, 2021).

Beazley’s Canadian form makes the same split Cowbell packs into a single sentence, except it puts it on the page. Question 1.7 asks whether you have an incident response plan addressing network incidents and data breaches, with two separate tick boxes: Have a plan and Tested in last year (Beazley Cyber Application, Canada, 2026). One question, two answers, and a twelve-month window on the second.

At the other end, Beazley’s large-account US form asks only Do you have an incident response plan for network intrusions and malware incidents? (Beazley Cyber Insurance Application, form F00657, 2023). A yes or no about a document. Nothing about testing at all.

Between them sits the shape used on public underwriting checklists. Indiana’s state cybersecurity hub publishes the questions underwriters ask, and its response planning section runs to 4 questions (Indiana Cybersecurity Hub, Cyber Insurance Toolkit, underwriting security controls questions, 2026). Three ask whether a document exists. The fourth asks about annual testing, and it attaches that to the disaster recovery and business continuity plan rather than the incident response plan.

One thing is true of all four, and most published advice has it backwards. Not one uses the words “tabletop exercise” or “simulation” anywhere in the incident response question, and not one says “at least annually”. The closest any of them comes to naming a cadence is Beazley’s twelve-month tick box. Carriers ask whether the plan is tested. The tabletop-and-annually phrasing comes from standards bodies and government checklists, and it gets read back onto forms that never said it. If you are preparing an answer, prepare it against the words on your form, not against the words in an article about forms.

What does a yes commit you to?

Take the strongest version apart. The Cowbell wording is not one question, it is four assertions bolted together, and a yes signs all four.

The clause	What it asserts	What answers it
“have an incident response plan”	A document exists	The plan itself, with a version and a date
“tested”	It has been exercised, not just read	A dated record of the exercise, naming the scenario and who took part
“in-effect”	This is the current, live version	Evidence it was approved and circulated, not a draft on somebody’s desktop
“setting forth specific action items and responsibilities for relevant parties”	It names actions and the people who own them	A plan with roles and decision rights, not a narrative of good intentions

Most organisations that answer yes are thinking only about the first clause. The one that most often fails on inspection is the last. A plan that describes a process in general terms, without naming who decides to notify customers or who can authorise a payment, does not set forth specific responsibilities for relevant parties, however good the process is.

The second clause, “tested”, is the one that needs something you cannot write yourself on the day the form arrives.

Who signs it, and what does the signature do?

This is the part of the application people skim, and it is the part that changes the stakes on every answer above it.

On the Cowbell form, the declaration is made by the undersigned authorized officer of the organisation, who declares that to the best of the organisation’s knowledge the statements in the application are true, accurate and complete, and it closes with Misrepresentation of any material fact in this Application may be grounds for the rescission of this Policy. (Cowbell Cyber Risk Insurance Application, Prime 250, 2020). The signature block asks for a name, a title, an email and a date.

Beazley’s form takes the same shape in different words. The signatory must be authorised by the applicant to sign on its behalf, and signs a statement that the responses provided are true and correct (Beazley Cyber Insurance Application, form F00657, 2023).

None of this is dramatic. Three things follow.

An application answer is a representation, not a form field. It is one of the things the carrier relied on when it agreed to the price.

The person signing is an officer, and it is frequently not the person who filled in the technical answers. In practice the questionnaire goes to IT, comes back, and gets signed by a finance or executive officer who has not seen the evidence behind any of it. That gap is worth closing before the form goes back, because the signature warrants the whole document.

And rescission is a different animal from a declined claim. It means the policy is treated as though it never existed. That is the carrier’s own language on its own form, and it is the honest reason to care about the answer. It is not a story about anybody’s voided policy.

A worked example: three companies, one question

Same question, same industry, three positions. The difference between them is entirely about what is on file.

Company A has a written incident response plan, approved two years ago, never exercised. No exercise record exists because no exercise happened. The honest answer is no. It is not a good answer, but it is a survivable one, and it costs less than the alternative.

Company B had the IT team walk through the plan at a staff meeting in the spring. Somebody remembers roughly when. There are no notes, no attendee list, and no findings. The team believes they tested the plan, and they are not being dishonest. They just cannot show it. A yes here is the most dangerous answer on the form, because it feels true and cannot be produced. The workable move is to answer no, or to answer yes with a dated note of what was actually done, and fix the position before the next renewal.

Company C ran a three-hour facilitated exercise four months ago. There is a report naming the scenario, the eight people who were in the room and their roles, the decisions they made, four findings with owners and target dates, and a signed statement from the facilitator confirming the session took place. The answer is yes, and everything needed to support it sits in one file.

The gap between B and C is not effort or budget. Both spent real time on it. The gap is that one of them produced a record and the other produced a memory.

What if the honest answer is no?

A no on this line is a data point, not a decline. It sits alongside a dozen other control answers and gets priced with them.

What matters more is the timing. The question is answered as at the date somebody signs the form, which means the facts are still yours to change up until then. Applications usually arrive 90 days or so before the policy incepts, and the broker wants the form back well before that. An exercise inside that window is 3 hours of your leadership team’s time, with a written report following within 15 days.

There are three positions available, and only one of them is bad:

• Answer yes, with a record behind it. Best position.
• Answer no. Weaker on price, entirely defensible, and it cannot be used against you later.
• Answer yes, with nothing behind it. The only one of the three that creates a problem in a year when you have a claim and somebody rereads the file.

What to keep on file so the answer holds

Whatever you answer, the file is what makes it stand up. Keep these together with the signed application:

• The incident response plan, with its version and approval date.
• The exercise report: scenario, date, participants and their roles, decisions, findings.
• The findings with an owner and a target date against each one, and whatever shows they were closed.
• A statement from somebody independent of your response confirming the exercise took place.

The first three you can produce yourself. The fourth is the one that needs somebody outside your own organisation, and it is the reason the question is on the form at all. A control that is only ever self-assessed is the easiest one on the whole application to overstate.