When does a cyber insurance renewal actually start?

Before the form arrives. Coalition publishes its own renewal timetable and opens the process 90 days before the policy expires (Coalition, How do Cyber renewals work at Coalition?, 2026). What happens after that depends on which path the renewal takes. On a standard renewal an updated quote is issued at least 30 days out and the policy takes effect on the expiry date. On an automatic renewal the policy binds and issues 7 days before expiry with no broker action at all, provided a live quote is already in place. Read the whole thing as a shape, not a rule. It is one carrier describing its own workflow, and the milestones belong to different routes through it. The useful part is what it implies: by the time somebody asks you whether you tested your incident response plan, the answer has already been decided by what you did or did not do in the preceding year.

What does the renewal calendar actually look like?

Here is an honest caveat first, because it changes how you should read every other page on this subject.

No regulator, no government agency and no broker association publishes a standard renewal lead time. We looked. The UK’s National Cyber Security Centre, the US Federal Trade Commission, NIST’s small business guidance, a 2021 US Government Accountability Office study of the cyber insurance market, and the Canadian federal guidance all discuss renewal without stating a number.

The “start 90 days out” figure that appears on dozens of pages traces back to nothing. It circulates between managed service provider blogs, each citing the one before it, with no underlying document at the bottom. That does not make it wrong. It makes it unsourced, which is a different problem and a more annoying one.

What does exist is carriers publishing their own schedules. Coalition’s servicing documentation is the clearest, and the three dates above come from it.

So the calendar below is built from the one published carrier timetable, working backwards. Treat the left column as approximate and the right column as the part that matters. Where a row belongs to one renewal path rather than to all of them, it says so.

Days before expiry	What is happening	Who produces it
120 to 90	Nothing yet, formally. This is the last window in which you can still change the facts rather than describe them	You
90	The renewal process opens. The broker asks for updated information and the application goes out	Carrier and broker
90 to 45	Control answers get gathered. Usually IT fills in most of the form	You
60 to 45	The broker wants the completed form back, earlier than you expect	You
45 to 30	Underwriting review. Questions come back on anything thin	Carrier
30	Standard renewal: an updated quote is issued, or a preliminary indication if the application is still outstanding	Carrier
30 to 7	Terms are negotiated. Any material change to your answers has to be reported now	You and broker
7	Automatic renewal: the policy binds and issues with no broker action, if a live quote is in place	Carrier

The row people miss is the first one. Everything from 90 days onward is reporting. The only window in which you can improve an answer rather than explain it is the one before the process starts.

Why does the date you sign matter more than the date you answer?

Because your answers have to stay true until the policy incepts, and the forms say so.

Cowbell’s application puts it plainly: If the information in this Application materially changes prior to the effective date of the Policy, the applicant will promptly notify the insurer, who may modify or withdraw the quotation. (Cowbell Cyber Risk Insurance Application, Prime 250, 2020). Beazley’s form carries the same duty in different words, with the insurer free to withdraw or modify any outstanding quotation if the position changes between the application date and the effective date (Beazley Cyber Insurance Application, form F00657, 2023).

That is the actual mechanism, and it is more useful than the thing people expect. There is no general rule that an application expires after some number of days. What there is instead is a continuing duty: the answers must be accurate on the day cover starts, not merely on the day you typed them.

Which cuts both ways, and the favourable direction is the one nobody mentions. If you answered no to the incident response testing question in week one and ran a real exercise in week six, that is a material change in your favour, and there is a mechanism for telling them about it.

What is actually due, and who produces it?

Most of a renewal file comes out of systems you already run.

The incident response plan, with a version and an approval date. Multi-factor authentication coverage. Backup and restore evidence. Endpoint coverage, patching cadence, training completion. All of it is logged somewhere with a date attached, and pulling it together is tedious rather than hard.

One line is different. A dated record that your incident response plan was exercised, with a confirmation from somebody independent of your response, is the only item on the list that cannot be produced from your own systems on a deadline. It is also the one most likely to be discovered late, because it looks like an administrative task until you try to do it.

Beazley’s Canadian application makes the split visible on the page. Question 1.7 asks whether you have an incident response plan addressing network incidents and data breaches, and gives two separate tick boxes: Have a plan and Tested in last year (Beazley Cyber Application, Canada, 2026). Two boxes, two different pieces of evidence, and only one of them is in your filing cabinet.

For scale: 22 percent of Canadian businesses held cyber risk insurance in 2023, up from 16 percent two years earlier (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024). More firms are answering these questions every year, most of them for only the second or third time.

How long does an exercise take, if you decide to run one?

The session itself is 3 hours. The written report follows within 15 days. From first conversation to delivered exercise, allow three to seven weeks. Scenario design needs a read of your actual plan, and the hard part is calendars, not preparation.

Put that against the timetable above and the arithmetic is not tight. Started at 90 days, it lands comfortably. Started at 45, it is a scramble that may still work. Started when the broker chases you for the form, it does not.

One honest note on how this usually goes. The exercises behind this template were not booked ahead of a renewal. They were booked afterwards, by organisations that had already had an incident, large or small, and wanted to know what they would do next time. Exercises run before anything has happened are rarer. They are also calmer, cheaper and better attended, because nobody in the room is defending a decision they already made.

We would rather you were in the second group. Most people are not, and pretending otherwise would be a strange way to open a working relationship.

What if you are already inside the window?

Work backwards from the date the broker needs the form, not from the expiry date. Those are different dates and the one that binds you is earlier.

Then be accurate. The temptation inside a compressed window is to answer the testing line optimistically on the grounds that you will sort it out afterwards. It is the wrong trade, because a weaker answer you can evidence is worth more than a stronger one you cannot, and because the material-change duty gives you a route to improve the answer later if you actually do the work.

If the renewal is genuinely too close, the better move is to answer honestly this year and put the exercise in the calendar for the quiet part of the cycle, roughly four months before the next one. That is the only time of year this is a planning exercise rather than a fire drill.