Do our own meeting notes count as proof we tested the plan?

They are the starting point and they are not sufficient on their own. Notes show that a meeting happened. What an underwriter is checking is that the exercise was real and that somebody independent of the response is willing to say so in writing. Keep the notes, and get the exercise witnessed.

Our IT provider ran a walkthrough for us. Does that satisfy the question?

It satisfies the part about having exercised the plan. It does not satisfy the part about independence, because a provider who built and operates the environment cannot credibly attest that the environment's response was independently tested. They are a good candidate to help design the exercise. They cannot be the witness to their own work.

How far ahead of renewal do we need to start?

About ninety days. The application usually lands sixty to ninety days before the policy incepts, and a witnessed exercise plus a written report needs a few weeks of that runway. Starting after the form arrives means answering it with whatever you already have.

What your carrier accepts as proof you tested your incident response plan

Your carrier will accept a dated written record that an exercise actually happened: what scenario was run, who was in the room, what decisions they made, what gaps it found, and a signed statement from someone independent of your response confirming it took place. Your own meeting notes are the raw material for that record. They are not the record. The gap between the two is the whole reason the question is on the form.

What is the application actually asking?

The incident response section of a renewal application is short, and it is doing more work than it looks like it is doing. It asks whether you have a written plan, when it was last updated, and whether it has been tested inside the last twelve months.

The third question is the one that causes trouble, because “tested” is not defined anywhere on the form. It is not a synonym for “read”. It is not a synonym for “reviewed at a management meeting”. It means the plan was put under pressure with the people who would actually have to run it, and that something was learned and written down afterwards.

That definition is not ours. It is the one written into regulation for financial services firms in New York, whose 2023 amendment requires covered entities to establish written plans that contain proactive measures to investigate and mitigate cybersecurity events, and to test them at least annually with the staff and management who are critical to the response (NYDFS, 23 NYCRR 500.16, 2024).

That rule binds NYDFS-licensed entities. It almost certainly does not bind you. It matters anyway, because it is the clearest published statement of what the word means to the people who write cyber policies, and underwriting language tends to follow it.

If no Canadian law requires this, why is it on the form?

Because the requirement is not coming from a regulator. It is coming from the contract.

There is no Canadian statute that tells a fifty to three hundred person law firm, clinic or software company to test its incident response plan every year. OSFI’s technology and cyber risk guidance binds federally regulated financial institutions: banks, federally regulated insurers, trust and loan companies. A provincial credit union answers to its provincial regulator. Almost every mid-market Canadian firm sits outside all of it.

Meanwhile the underlying risk is not theoretical. 16 percent of Canadian businesses reported being impacted by a cyber security incident in the most recent national survey (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024). Carriers are pricing that, and the questions on the form are how they price it.

So the binding document is the application you sign. That is a narrower obligation than a regulation and, in one specific way, a sharper one. A regulator can fine you. An application answer is a representation you make to induce a contract, and it is read again, closely, at exactly the moment you need the contract to work.

Did an insurer really void a policy over an untested plan?

No. This story circulates constantly and it is worth correcting, because you have probably read some version of it and because the version people repeat is not what happened.

The case usually cited is Travelers Property Casualty Company of America v. International Control Services, Inc., No. 22-cv-2145 in the United States District Court for the Central District of Illinois. Travelers filed in July 2022 to rescind a cyber policy, and the parties stipulated to rescission the following month. The policy was declared void from inception.

The alleged misrepresentation was about the scope of multi-factor authentication. It was not about incident response plan testing. Anyone telling you a carrier voided a policy because the insured lied about testing its plan is repeating something that did not happen.

The real risk is both smaller and more general, and it does not need the embellishment. An answer on an application is a representation. A material misrepresentation about a control is grounds for rescission, and rescission means the policy is treated as though it never existed. That principle is well established and the Travelers case is a live demonstration of it. It just was not about this control.

Which leaves the honest version: a “yes” you cannot evidence is not a catastrophe waiting to happen. It is an unnecessary weak point in a contract you are buying specifically for the days when everything else has already gone wrong.

What counts as evidence, and what does not

Most of a renewal application asks for things you can prove from your own systems. The incident response testing line is the exception.

What you can show	Who produces it	Does it answer the question?
The written incident response plan	You	Answers “do you have a plan”, not “have you tested it”
A dated calendar invitation and attendance list	You	Shows a meeting occurred. Says nothing about what was tested
Internal meeting notes or a hot wash summary	You	Useful raw material. Self-produced, so it evidences your account of the exercise
A scenario, injects and decision points	You or a facilitator	Shows the exercise had structure and was not a discussion
A written after-action report with findings and owners	A facilitator	Answers the question, if it contains real findings
A signed attestation that the exercise took place	An independent third party	The part you cannot produce for yourself

The pattern is the point. A renewal application runs to roughly a dozen control areas, and you can evidence almost all of them from records you already hold. Backups, multi-factor authentication, endpoint coverage, patching cadence, training completion: all of it is in a system somewhere with a date on it.

Incident response testing is the one line where the artifact that satisfies it has to come from outside your own organisation. That is not a quirk of the form. It is the reason the question exists at all, because a control that is only ever self-assessed is the easiest one to overstate.

What if the exercise finds real problems?

It will, and this is where the process most often goes sideways.

The exercises behind this template have produced a recurring conversation: once the report is drafted, clients ask for recommendations to be dropped or softened. The reason given is optics. The reason underneath is that nobody has decided to act on them.

The instinct is understandable and it is the wrong trade. A report with no findings does not read as a clean bill of health. It reads as a demonstration rather than a test, and an underwriter who has seen a hundred of these can tell the difference in about a minute. Findings are what make the document evidence that something was actually stressed.

The workable answer is not to remove the finding. It is to give it an owner and a date. A report that says a gap exists and that it closes by the end of the quarter is a stronger document than one that says nothing was wrong, and it is a far stronger document than one that says a gap exists and leaves it hanging.

How long does this take?

Plan on the 90-day runway. Your application typically arrives sixty to ninety days before the policy incepts, and the broker wants it back well before that.

Inside that window the exercise itself is 3 hours of your leadership team’s time. The written report follows within 15 days. The rest of the runway is scenario design, a read of your existing plan, and time to close anything urgent the exercise surfaces before you sign the form.

Starting after the application lands is not fatal. It just means answering the question with whatever you happen to have, which is the situation the question was designed to expose.

Where to start

If your renewal is more than ninety days out, work through the control list and find out which lines you can already evidence. Most firms discover they are in better shape than they assumed on eleven of them, and have nothing at all on the twelfth.

If your renewal is inside ninety days, work backwards from the date the broker needs the form. That is the constraint, and it is a harder one than it looks.