What does a cyber insurance readiness review actually check?

It checks whether you can prove each answer on your renewal application before anyone asks you to. Not whether the controls exist. Whether a dated record shows they do. Most of an application passes that test from files you already hold: an export from your identity provider, a backup log, last month’s patch report. The line that is hardest to back up is the tested incident response plan. Its evidence is a record of something that happened in a room, and somebody other than you has to have been there.

What is cyber insurance readiness?

The distance between the box you tick and the record you can produce.

An application looks like a survey. It is closer to a signed statement. Cowbell’s application is signed by the undersigned authorized officer of the organization, and it closes with this: Misrepresentation of any material fact in this Application may be grounds for the rescission of this Policy. (Cowbell Cyber Risk Insurance Application, Prime 250, 2020). Rescission means the policy is unwound as if it had never been written.

So readiness is not a security score. It is whether every yes on the form has a document behind it, with a date on it, generated by a system rather than typed by whoever filled in the form. A readiness review is the read an underwriter would do, done by you, while there is still time to fix what it finds.

Which controls do current applications ask about?

The wording changes from carrier to carrier. The subjects barely do. These are the twelve rows we work from, the same twelve as our renewal readiness checklist, with the check a review applies to each and the kind of answer that does not pass it.

Control	What the review checks	What does not pass
Multi-factor authentication	A dated export showing it enforced on email, remote access and every administrator account	A policy that says it is required
Endpoint detection and response	Coverage as a count of devices, and who watches outside business hours	A percentage with nothing behind it
Backups	The record of the last restore: the date, what came back, how long it took, who ran it	A log showing the backup ran
Administrator accounts	A list of privileged accounts with an owner and a last review date	“IT looks after that”
Patching and unsupported systems	The latest scan summary, with an owner and a date against each unsupported system	A patching policy
Email authentication	Your published SPF, DKIM and DMARC records and the DMARC policy value	An answer the underwriter can check from outside and contradict
Training and phishing tests	A dated completion report and the result of the last simulation	“Everyone does annual training”
Remote access	Every path into the network, with the authentication on each	Remote desktop open to the internet
Payment verification	The written callback procedure, the threshold, and something showing it is followed	Anything from IT. This row belongs to finance
Vendors and outsourced IT	What each provider can reach, and the incident clause from the contract	A vendor list with no access detail
A written incident response plan	The plan, dated, with named roles and contact details that work without company email	A plan nobody can open during an outage
A tested incident response plan	A dated report naming the scenario, the roles in the room and the findings, signed by whoever ran it	Your own notes of a meeting

Eleven of those rows are files. The twelfth is an account of an event, and what it is worth depends on who gives the account.

Which ones are hardest to evidence?

Three, and for different reasons.

The tested plan comes first, because it is the only row where the evidence is something that happened rather than something you can export. Beazley’s Canadian application prints the split on the page. It asks whether you have an incident response plan, then gives one box for Have a plan and another for Tested in last year (Beazley Cyber Application, Canada, 2026). Only the first box can be answered from a filing cabinet.

Payment verification is second. It belongs to finance, and a review run only by IT will walk straight past it. In Coalition’s 2026 claims report, 58 percent of the incidents it observed were business email compromise or funds transfer fraud (Coalition, 2026 Cyber Claims Report, 2026). That is one carrier’s own policyholders, not the whole market. It is still more than half.

Restores are third. The question is not whether the backup runs. It is when you last brought something back from one, and how long that took. A log answers the first question and says nothing about the second.

How do you check readiness yourself?

Most of it needs nobody’s help.

Ask your broker for the application you submitted last year. Those answers are your starting point, and they are what this year’s answers will be compared against.

Work down it one line at a time. For every yes, find the record that proves it and save a copy in one folder with the date visible. For every answer you cannot back up, write the gap down in one plain sentence before you decide anything about it. Writing it first stops it from being quietly rounded up later.

Then check the calendar. Coalition, for one, starts its renewal process 90 days before the policy expires and issues an updated quote at least 30 days before it ends (Coalition, How do Cyber renewals work at Coalition?, 2026). Whatever you cannot fix inside that window, you will be explaining instead.

If you would rather work from a page than an empty folder, our renewal readiness checklist has all twelve rows with the evidence for each.

What does an independent review add?

Two things you cannot do for yourself. A reader who has never seen your answers, and a gap list written by somebody who did not fill in the form.

That is what our Renewal Readiness Review is. We read your incident response plan and your renewal questionnaire, and within five business days you have a written list of what is missing. It costs $2,500, and the full amount comes off the price of a tabletop if you book one within two weeks.

It is a diagnostic. It tells you whether the tested-plan row needs an exercise before this renewal, and what else needs fixing. It does not test the plan, and it is not a way around testing it. Ask for it when you book a call.

What happens if you find a gap thirty days before renewal?

Take a firm that starts late. The broker sends last year’s application back with a month to go, around the point where one carrier issues its updated quote. Eleven rows check out. Row twelve does not. The plan exists. It has never been tested.

The decisions come in a fixed order.

What to tick. The honest answer is that the plan exists and has not been tested in the last year. Ticking the second box without a record behind it turns a gap into a statement, signed by an officer of the company.

Whether an exercise can happen in time. In the exercises we have run, the room was usually booked after something had already gone wrong, and the time from first conversation to a delivered exercise ran three to seven weeks. A month sits inside that range, at the short end. If it runs long, the report will not exist when the form goes back.

What to say instead. If the exercise is booked, say so: the date, the scenario, and who will be in the room. Then ask your broker how this carrier treats a test that is scheduled but not yet done. Nobody publishes a rule on that, so ask.

Start when the carrier does, 90 days out, and none of this is a decision. It is a date in the calendar.