insurer asks security questionnaire for cyber insurance what should I do

Insurers ask the same ten measures, but want evidence

A cyber insurer poses questions that largely overlap with Article 21(2) of NIS2: incident response, backups, MFA, patch policy, supplier management. The difference from a NIS2 questionnaire sent by a customer is that the insurer wants concrete evidence, not policy intent. Where a supply chain partner is satisfied with "yes, we have a procedure", the insurer often wants to know whether there is a procedure for handling security incidents including recovery time, and whether multi-factor authentication is mandatory for all external access or only for admin accounts. That granularity difference is where most uncertainty arises: an answer that suffices for one questionnaire may be too general for another.

If a measure exists but is not consistently applied everywhere — for example MFA on the cloud environment but not on the VPN — the standard answer is "partial" with a brief explanation, not a "yes" that could later put coverage into question. The same applies to questions about backups and contingency provisions and about security requirements for own suppliers the insurer often assesses retrospectively, at the time of a claim, whether the answer was correct. An ISO 27001 certificate accelerates this process significantly, because the certificate Annex A allows the measures to be audited independently — without a certificate you must provide evidence yourself for each question.

Why insurers ask slightly more than the ten NIS2 measures

The ten measures under Article 21(2) of NIS2 form the core of virtually every security questionnaire, cyber insurers included, but insurers often supplement this with questions specific to risk assessment in a claim — such as the scope of MFA or recovery time after an incident. ISO/IEC 27001 Annex A sets out, for each measure, the control measures with which you can substantiate an answer, which is particularly relevant because insurers ask for evidence more often than other customers.