The cyber insurance application had 47 questions. Only 3 were about money.

The cyber insurance application had 47 questions. Only 3 were about money.

The rest were about our backups, our logins, and whether we'd ever tested any of it.

We're a small team. No security engineer, no IT department. When our broker sent the cyber insurance application I expected the usual: revenue, headcount, industry. Instead I got twelve questions about controls — MFA, backups, patching, offboarding — each one a representation we'd be signing.

Here's what filling it out honestly taught us.

The form is the security audit.

Nobody from the insurer visits a 12-person company. The application is the risk assessment, and every "yes" is a legal representation. Tick "regularly tested backups" and you have just promised a courtroom that your backups are regularly tested. Ours weren't. The backup job said "successful" every night. We had never once restored from it.

That's the trap: the form doesn't ask "do you have backups." It asks whether they're tested. A dashboard status is not a test.

The twelve controls, in the order the form asked:

1. MFA on email and admin accounts (email first — business email compromise is the #1 small-business claim)
2. Backups: offsite, at least one offline or immutable, and tested
3. Endpoint protection on all laptops and servers — "all" being the word
4. A documented patching cadence (critical patches within 14 days)
5. No end-of-life systems touching the internet
6. An offboarding process that removes access the same day
7. Unique accounts — no shared logins anywhere
8. A written incident-response plan (one page counts)
9. Log retention long enough to investigate (30 days minimum)
10. Disk encryption on laptops (FileVault/BitLocker — the cheapest "yes" on the form)
11. A password manager
12. Security awareness training, annually

We had maybe seven of twelve for real. The other five were "true in spirit."

What actually moved the needle:

The restore test. One afternoon, restore last night's backup to a scratch machine, write down the date and the time it took. That single document turned our weakest answer into our strongest.

The MFA enforcement screenshot. "Yes to MFA" plus a screenshot of the enforce toggle beats a paragraph of intent.

The one-page IR plan. Ours said who calls whom in the first hour and who talks to the insurer. It fits on one page because that's all you can execute at 2am anyway.

The answers that quietly void claims:

• "Tested backups" with no test date anywhere
• "MFA enforced" on an account that still has a shared service login
• "We have an incident-response plan" that lives in someone's head
• "No known incidents" when there was one — discovered later, that's the policy

Underwriters price honesty. Adjusters punish fiction. We answered one question with a roadmap instead of a yes — "MFA enforcement completes 30 Sep" — and the underwriter priced it fine. Optimistic defaults from the broker pre-fill were the thing to watch: every pre-ticked box becomes our representation once the policy binds.

And the renewal re-asks everything. The controls have to stay true all year, because next year's application re-certifies this year's answers. So the checklist went on a calendar: quarterly restore test, quarterly MFA exception review, annual full sweep before the renewal form arrives.

The pattern across all twelve questions: insurers don't buy your intentions. They buy your evidence. A small team that runs the restore test, enforces MFA properly, and keeps a one-page IR plan answers every question with a document instead of a hope — and gets the rate that reflects it.

We wrote up the full checklist — the twelve controls in form order, the void-a-claim answers, and the evidence folder to build before you apply — as a free ops note:

→ Cyber insurance for small teams: the 12 controls the application actually checks

If you're filling one of these forms this quarter, read it first. It's faster than a denied claim.

---

This note is part of the HIVE80lab ops kit — free checklists for teams with no ops department. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.