What does a cyber-insurance quote actually require
A cyber-insurance quote mostly requires you to describe your business and your security setup honestly. The insurer wants to know what you do, how much data you hold, how much money moves through your systems, and which basic protections you already have. Answer those accurately and you'll get a quote you can rely on. Guess, or give the answers you hope are true, and the number may be wrong or the policy may not pay when you need it.
The basic facts about your business
Start with the easy stuff. Expect to give your business name, address, legal structure, industry, and number of employees. Insurers also ask for annual revenue, usually for the most recent full year plus an estimate for the year ahead. Revenue matters because it shapes how much a breach could cost you, and it often sets the range of coverage limits you can choose.
Then there's data. The insurer will ask roughly how many personal records you store, such as customer names with email addresses, payment details, health information, or staff records. Give a rough count rather than leaving the box blank. If you don't know the exact number, work from your customer list or accounting software and say it's an estimate. Also say whether you take card payments, and if you do, whether a payment provider handles the card details for you. That single answer can change the premium quite a bit.
The security questions insurers care about most
This is the part most people underestimate. Most insurers now ask a set of yes or no questions about your controls, and the answers carry real weight. Typical questions cover:
- Multi-factor authentication, which is a second check such as a code from your phone on top of your password, on email and remote access accounts
- Whether backups are kept separate from your main systems and tested by actually restoring from them
- Whether every laptop and server runs up-to-date antivirus or endpoint protection
- How quickly you install security updates and patches
- Whether staff get regular training on phishing and fake payment requests
- How you confirm a change to a supplier's bank details before you pay
- Whether you have a written plan for what to do if you're hacked
Answer each question as things stand today, not as you plan to have them. If you're partway through turning on multi-factor authentication, answer no and note that it's in progress. A quote built on a yes that isn't true is the kind of thing that causes trouble later, which brings us to the next point.
Why accuracy matters more than a low number
Your application is usually signed by someone in the business, and the answers often become part of the policy. If you claim a control you don't have and a claim follows, the insurer may refuse to pay or reduce the payout. A cheaper quote built on optimistic answers is no bargain for that reason. Read the policy summary and any statement attached to the application before you sign, and keep a copy of what you submitted.
If a question is unclear, ask the person who sent it. Insurers and brokers would much rather clarify before the policy starts than dispute a claim later. Be honest about past incidents too. Most applications ask whether you've had a breach, a ransomware attack, or a claim in the last few years, and even a small incident you handled yourself should be disclosed.
How to get your quote moving quickly
Gather the information before you start. A simple list helps: revenue and headcount, a rough count of records, a note on card payments, your current IT setup (who manages it, and what you use for email, backups, and remote access), and any past incidents. Then ask for quotes on the same coverage limits and the same deductible. Comparing a cheap policy with a low limit against a fuller one with a higher limit tells you very little.
Expect a follow-up. Some insurers send a supplemental questionnaire, some scan your public-facing systems from the outside, and some ask for a short call. Reply within the time they give, since a stalled application can push back your start date. Once you have the quote, check the exclusions and whether you must keep certain controls running after the policy begins. Some policies only respond if multi-factor authentication or backups stay in place.
The next step is straightforward. Pull together the list above, spend half an hour checking your security answers with whoever looks after your IT, and then send the request to your broker or insurer. If you're unsure how a question applies to your setup, ask before you answer. That one conversation usually saves a rewrite later.