Proof, Not Promises: Getting Through a 2026 Cyber Insurance Questionnaire Without a Security Team

The cyber insurance renewal arrives as a PDF with forty questions, a deadline and a slightly ominous note about 'material facts'. For a small business without a dedicated security team, it can feel like being asked to sit an exam for a subject nobody taught.

The good news is that most of the questionnaire is not asking you to be a bank. It is asking whether you have done the basic, sensible things — and whether you can prove it. In 2026, insurers have sharper data on ransomware claims and a clearer sense of which controls actually reduce losses. They are not looking for perfection. They are looking for evidence.

Why the questions got sharper

A few years ago, many small business cyber policies were sold on turnover and a tick-box declaration. After a run of ransomware and payment fraud claims, underwriters started asking for more. Does the firm actually use multi-factor authentication? Has anyone ever restored a backup? Is there a plan for the first hour after a suspected breach?

The questions are not a judgement on your IT department. They are how the insurer prices risk. A firm that can show tested backups and enforced MFA looks different from one that says 'our IT man deals with that'. The aim of this article is to help you answer honestly, with evidence, and without buying a security operations centre.

The four questions behind most questionnaires

Most 2026 small business questionnaires circle back to four themes:

1. Multi-factor authentication on email, remote access and admin accounts.
2. Backups that are isolated from the main network and have been tested.
3. A written incident response plan with named contacts.
4. Regular security awareness training for staff.

There are usually others — patching, endpoint protection, privileged access, payment controls — but those four carry the most weight. Let us take them one at a time.

'Do you enforce MFA on email and remote access?'

What the insurer is really asking: if someone's password is stolen, can an attacker walk straight into email or remote desktop? They want to know that a second factor is required, not merely available.

If you use Microsoft 365, gather three simple screenshots from the Entra admin centre: the MFA registration report, the conditional access policies that require MFA, and a sign-in log showing a successful MFA challenge. Add the date to each screenshot. If you use Google Workspace, the equivalent is the security centre and the user enrolment report.

Be honest about exceptions. If the managing director refuses MFA on their phone, say so and explain the compensating control. Insurers dislike surprises more than gaps.

'Are your backups tested?'

What they are really asking: when ransomware hits, will you pay the ransom or restore from backup? They want to see an isolated or immutable copy and evidence of a restore.

You do not need a data centre. A backup tool that keeps an offline copy, plus a quarterly restore test, is a credible answer. Keep a one-page record: date, what was restored, who did it, how long it took and whether it worked. A screenshot of a successful restore is worth more than a paragraph of reassurance.

If you have never tested a restore, do not write 'yes'. Write 'not yet tested — first test scheduled for [date]' and then actually do it. An honest gap with a plan is easier for an underwriter to accept than a claim that collapses during a claim.

'Do you have an incident response plan?'

What they are really asking: when something goes wrong at 7am on a Monday, who calls whom? The plan does not need to be fifty pages. One page is fine if it covers:

• who declares an incident and who deputises;
• how to isolate an affected device or account;
• who contacts the insurer, the bank and any key suppliers;
• how you would report a personal data breach to the ICO within 72 hours if required;
• where the offline copy of the plan is kept.

Print it. Put it in the folder with the insurance policy. Review it once a year. If you have never used it, say so; a plan that has been read and dated is still evidence of preparation.

'How do you train staff?'

What they are really asking: do people know what a phishing email looks like, and would they tell someone? A short quarterly briefing, a recorded session or a phishing simulation all count. Keep the attendance sheet or the learning platform completion report.

The evidence does not need to be fancy. A spreadsheet with names, dates and a one-line topic is enough. If you have never run training, start with a fifteen-minute session on invoice fraud and password hygiene, then record it.

The questions that trip people up

Beyond the big four, watch for:

• privileged or admin access — who has it, and is it separate from day-to-day accounts?
• patching — do you apply critical updates within a set window?
• endpoint protection — is antivirus or EDR on every laptop and server?
• remote access — is it through a VPN or a managed remote tool, not an open RDP port?
• third parties — do you know which suppliers hold your data?
• payment fraud — are there call-back checks for changes to bank details?

Answer in plain English. 'Yes, managed by our IT provider, reviewed quarterly' is a good answer. 'We have never had a problem' is not.

Build a renewal evidence pack

Create a folder — cloud or physical — with an index page. Include the MFA screenshots, the backup restore record, the incident plan, the training log, the asset list and any relevant policies. Date everything. When the questionnaire asks for proof, you are not scrambling; you are attaching page four of a pack you already have.

The whole exercise should take an afternoon, not a month. And if a question exposes a real gap, fix the gap rather than polishing the wording. That is the quiet advantage of the 2026 questionnaire: it forces a small firm to write down what it actually does. The insurers call that evidence. The rest of us can call it knowing where the light switches are.