For the renewal file
Ten questions, and what each one is really asking
Of the ten incident response questions below, nine are answered by a file you or your IT provider can produce this week. One of them needs a signature from somebody who does not work for you, and it is the one most applications put in the middle of the page where it looks like all the others.
Where the question wording comes from
Cyber applications are the property of the insurers who write them and no two are identical. The "how it typically reads" line under each question below is our own composite phrasing, written to match the shape these questions take so you can find the equivalent line on your own form. It is not reprinted from anybody's application.
Where a form is quoted directly it is in quotation marks with a source beside it. Three real ones are worth having in front of you. Beazley's Canadian application asks whether you have an incident response plan addressing network incidents and data breaches, with two separate tick boxes, Have a plan and Tested in last year (Beazley Cyber Application, Canada). Cowbell asks Does the organization have an incident response plan, set off mid-sentence by tested and in-effect, and continuing setting forth specific action items and responsibilities for relevant parties in the event of a cyber incident or data breach matter? (Cowbell Cyber Risk Insurance Renewal Application, Prime 250). And on the vendor side, the Cloud Security Alliance's Cloud Controls Matrix control SEF-04, Incident Response Testing, requires you to Test and update as necessary IR plans at planned intervals or upon significant organizational or environmental changes for effectiveness (Cloud Security Alliance, Cloud Controls Matrix, SEF domain).
Read those three together and the pattern is clear. Every one asks whether the plan was tested. Not one asks who tested it.
The two readers
An application looks like a survey and behaves like a sworn statement. Every box you tick is a representation about how your organisation runs on the day you sign it.
The first reader is an underwriter deciding whether to quote and at what price. They read quickly and are looking for reasons to be comfortable. The second reader appears only if something goes wrong. They read slowly, with the facts of the incident beside your answers, looking for the distance between the two. Write for the second reader and the first is satisfied anyway.
Seven words that change the answer
Most of the difficulty in these forms sits in single words. Read each question once for meaning, then again for these.
| Word | What it narrows the question to |
|---|---|
| Written | A document that exists now and can be produced within the hour. Not a shared understanding, not a page somebody is drafting. If the plan is in one person’s head, the honest answer is no. |
| Tested | Something happened, on a date, that put the plan under pressure and produced a record. A read-through with no record does not survive the second reader. |
| Exercised | Stronger than tested. It implies a scenario and participants rather than a review. Where a form uses this word, a tabletop is what it has in mind. |
| Annually | A programme that repeats. Answering yes on the strength of one exercise three years ago is a different statement from the one being asked for. |
| In the past 12 months | A date question wearing a yes-or-no costume. It is the most useful question on the form, because it tells you exactly what evidence will satisfy it. |
| All | As in all employees, all endpoints, all privileged accounts. One exception makes the answer no. Say no and describe the exception. |
| Do you | Present tense. It describes how the organisation runs on the day of signature. A rollout planned for next quarter has no box on this form. |
The rule underneath all seven: if answering yes requires you to explain the answer, write the explanation in. Every application has a remarks field and underwriters read it. A qualified yes with a date beside it is worth more than a bare yes, and it cannot be held against you later.
The ten questions, decoded
Q1 The written plan
How it typically reads. Does the applicant maintain a written incident response plan?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer, drafted by the senior IT lead | CIO or Head of Information Security | The named owner on the plan |
What the underwriter is asking
Whether, at two on a Sunday morning, somebody who is not your most senior technical person can open a document and know what to do first. They are pricing the first four hours, which is where most of the cost is decided.
What counts as evidence
A dated document with a version number and a named owner. Roles by title, an escalation path, contact numbers, a decision authority, and instructions for reaching all of it when the network is down.
Trap. A disaster recovery plan is not an incident response plan. One restores systems, the other decides things. Many applications ask about both separately and score them separately.
Q2 Currency of the plan
How it typically reads. When was the plan last reviewed or updated?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer | The plan owner, usually Head of Information Security | The document version history |
What the underwriter is asking
Whether the plan describes the organisation you are now. A plan older than about eighteen months usually names people who have left and systems you no longer run, which tells the underwriter it has never been used.
What counts as evidence
A version history inside the document itself, showing what changed and why. Reviewed with no change is a legitimate entry if it is dated and signed off by the owner.
Trap. Changing the date on the cover page is not a review, and it is the first thing to fall apart if the plan is ever read beside an actual incident.
Q3 Has it been tested. Needs a witness
How it typically reads. Has the incident response plan been tested in the past 12 months?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer | Head of Information Security | Whoever ran or commissioned the exercise |
What the underwriter is asking
Whether the plan has ever met resistance. An untested plan is a document. A tested plan is a document plus the knowledge of where it breaks, and the second is worth underwriting differently.
What counts as evidence
A dated record of the test, what it covered, who took part and what it found. The finding is the part that matters. A test that found nothing reads as a test that was not really run.
Trap. This is the only question of the ten that can be answered yes with nothing at all behind it. Every other question points at an artifact that either exists or does not. This one points at an event, and an event leaves no trace unless somebody wrote it down at the time.
Q4 Tabletop exercises specifically. Needs a witness
How it typically reads. Does the applicant conduct tabletop exercises, and how frequently?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Executive or Managing Partner, because they have to be in it | CIO, with the Security Operations Manager running it | The after-action report |
What the underwriter is asking
Whether your leadership has practised deciding, not whether your technical team has practised responding. A tabletop is a discussion-based session where people with real authority work a scenario against a clock.
What counts as evidence
An after-action report: scenario, participants, timeline, findings, recommendations with owners. Independently facilitated is materially stronger than self-run, for the reason set out below.
Trap. A phishing simulation is not a tabletop and a penetration test is not one either. Those test controls and people. A tabletop tests decisions and authority, which is the layer that determines what an incident costs.
Q5 Who took part
How it typically reads. Which functions participate in incident response testing?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer | Security Operations Manager | The attendance record from the session |
What the underwriter is asking
Whether anybody who can authorise money, sign a public statement or decide about notification was in the room. An exercise attended only by the technology function tells them nothing about the decisions that drive a claim.
What counts as evidence
An attendance record by role showing at least the chief executive or a direct report, finance, legal or privacy, communications and technology. Roles rather than names is fine and usually preferable.
Trap. Answering with a headcount instead of a role list. Twelve people from one department is a smaller answer than five from five departments, and the reader can tell which one you gave.
Q6 What happened afterwards
How it typically reads. Were the findings from the most recent test remediated, and was the plan updated?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer | CIO, evidenced by the security manager | The recommendation tracker |
What the underwriter is asking
Whether testing is a compliance ritual or a loop that changes something. This question separates organisations that exercise from organisations that can produce a certificate.
What counts as evidence
The recommendation table from the last after-action report with completion dates filled in, and a plan whose version history shows the reissue that followed.
Trap. This is the question most likely to be revisited at claim time, because it is the one that can be checked against a document you already handed over.
Q7 Pre-arranged external help
How it typically reads. Has the applicant pre-arranged incident response, forensic or legal support?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Operating Officer, with the firm’s usual lawyer | General Counsel, with the CISO | The engagement letter, or the panel list in your policy |
What the underwriter is asking
Whether the first hour will be spent responding or shopping. Cyber policies also commonly restrict who you may engage, either to an approved panel or subject to consent, so read your own wording before you retain anyone.
What counts as evidence
A signed engagement letter or retainer with an after-hours number, or a written record of the panel your policy provides, held somewhere other than the systems that might be encrypted.
Trap. Naming your own internal legal team. Where privilege matters, forensics are usually engaged through external counsel, and an internal team can create the conflict rather than avoid it.
Q8 Backup restoration testing
How it typically reads. Are backups tested for restoration, and how often?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Your managed service provider, countersigned by the IT lead | IT Operations or Infrastructure Manager | The dated restoration log |
What the underwriter is asking
The other testing question, and the one carriers scrutinise hardest, because unrestorable backups are the mechanism by which a manageable ransomware event becomes a total loss.
What counts as evidence
A dated restoration log recording what was restored, how long it took and who confirmed it. A screenshot with a visible date is worth more here than a policy stating that restores are tested quarterly.
Trap. Backups completing successfully is not restoration testing. It is a different question from the one on the form, and it is the most common substitution we would look for.
Q9 Notification obligations
How it typically reads. Does the applicant have a documented process for assessing and making breach notifications?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Owner, Managing Partner or CFO, with external counsel | General Counsel or Privacy Officer | The notification decision tree |
What the underwriter is asking
Whether you know your own reporting clocks and who starts them. Notification is one of the few parts of an incident with a legal clock attached, and the decision usually has to be made before the facts are settled.
What counts as evidence
A named decision owner, the federal and provincial thresholds that apply to you, the record-keeping obligation, and the notification clocks written into your customer agreements.
Trap. Treating this as a legal question to answer later. Customer contracts often carry their own notification clock and it can be shorter than the statutory one. Read your top five agreements before you need to, not during.
Q10 Reporting to the board
How it typically reads. Is cyber risk reported to the board or to senior management, and how often?
| Accountable owner, 50 to 150 people | Accountable owner, 150 to 500 people | Where the evidence sits |
|---|---|---|
| Chief Executive or Managing Partner | CIO, reporting into the board | The minute |
What the underwriter is asking
Whether cyber risk is owned above the technology function. This is a governance question rather than a technology one, and it is asked of the business, not of IT.
What counts as evidence
Minuted board or executive discussion at a stated frequency, with the material that was tabled. An after-action report tabled at a board meeting answers this question and Q3 with the same artifact.
Trap. Answering yes because there is an annual IT update. The question is about cyber risk as a business risk, not about a technology roadmap presentation.
The role columns are who owns the answer in a company of 50 to 500 people. In a smaller firm one person often holds several of them, which is fine. What matters is that somebody is named before the form is signed, rather than after it is queried.
What a tabletop is, since two of these questions turn on it
NIST's definition is blunter than most people expect. A tabletop exercise is one where personnel meet in a classroom setting or in breakout groups to discuss their roles during an emergency and their responses to a particular emergency situation (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities). No systems are touched. Nothing is attacked. It is a conversation with a scenario and a clock, and what it tests is whether the people who can authorise things know what they would authorise.
Why self-run and witnessed are not the same answer
Nothing here requires you to hire anyone. You can write the plan, run the exercise and produce the report. On one row of this table, and only one, the answer changes.
| What the question wants | Self-run exercise | Independently facilitated |
|---|---|---|
| A dated record that it happened | Yes, if you keep one | Yes |
| A scenario written for your business | Yes | Yes |
| An attendance record by role | Yes | Yes |
| Findings and recommendations | Yes, with the caveat below | Yes |
| A written report in a recognisable format | Yes, with effort | Yes |
| A statement from somebody with nothing to gain, confirming it took place as described | No. Structurally not available. | Yes |
The caveat on findings. The hardest finding to write about yourself is the one about your own authority. In a self-run exercise the person facilitating usually reports to somebody in the room, and the finding that the chief executive was the bottleneck tends not to survive the drafting. That is not dishonesty, it is ordinary organisational gravity, and it is why the outside version reads differently.
Self-run quarterly and witnessed once a year is a good pattern, and it is what we recommend to most organisations. The quarterly sessions build the habit. The annual one produces the evidence.
The evidence pack
Assemble these once and Q1 through Q10 answer themselves, this year and next. Keep the folder somewhere an incident cannot reach.
| # | Artifact | Answers |
|---|---|---|
| 1 | Incident response plan, current version, with a version history page | Q1, Q2 |
| 2 | After-action report from the most recent exercise | Q3, Q4, Q5 |
| 3 | Signed attestation of that exercise | Q3, Q4 |
| 4 | Recommendation tracker with completion dates | Q6 |
| 5 | Engagement letter or retainer for breach counsel, plus the carrier panel list | Q7 |
| 6 | Restoration test log, dated, with confirmation of who verified it | Q8 |
| 7 | Notification decision tree, and the clocks from your top customer agreements | Q9 |
| 8 | Board or executive minute recording the cyber risk discussion | Q10 |
| 9 | A one-page index of the above, with dates, for your broker | All |
Eight of the nine you can assemble this week. Item 3 is the exception, and it is the one two of the ten questions are actually asking about.
If you cannot answer yes
Answer accurately in the negative, describe the compensating control, and give a remediation date. Underwriters price uncertainty, and a specific no with a date is less uncertain than a vague yes. A no does not usually lose you the coverage. An unprovable yes can lose you the claim.
If your renewal is inside the next 90 days and item 3 is missing, that is the conversation to have now rather than in the week the form is due.
Not advice. This is not legal advice, not insurance advice, and not a statement about how any carrier will treat any answer. We are not a broker and we do not place coverage. Your broker knows your market. Use this to have a better conversation with them.