A cyber insurance renewal evidence checklist can help your business prepare for a renewal questionnaire without relying on memory or assumptions. Gather records that show what protections are in place, which systems and accounts they cover, and when the information was verified.
Insurer forms and documentation requests vary, so this checklist is a way to prepare, not a substitute for your insurer’s or broker’s instructions. Answer each question based on your current environment. If a control is partial, planned, or unverified, clarify that rather than describing it as fully implemented.
Start with a simple evidence folder
Create a dated folder for the renewal and add an index that identifies the evidence, the system or accounts it covers, the person responsible for checking it, and where the record came from. Examples might include a report from an identity platform, a backup provider’s job history, or an approved policy document.
Keep the material current and relevant to the questions asked. Avoid sending broad collections of sensitive records unless your insurer or broker requests them. Ask how to provide requested documents securely, and confirm whether they need attachments or simply want you to retain evidence.
Evidence to gather before completing the form
Multifactor authentication and account access
- MFA coverage: Find a current report or settings record showing whether MFA is enabled for business email, remote access, and administrator accounts. Note any accounts or systems that are excluded, and why.
- Scope and exceptions: Record which users, applications, and access paths are covered. A policy stating that MFA is required does not by itself show that it is enabled everywhere the questionnaire asks about.
- Administrative access: Keep a current list or review record of privileged accounts and who is authorized to use them. Check that departed staff or old accounts are not still included.
For practical guidance on MFA for small and medium-sized businesses, see CISA’s MFA recommendations. Use your system records to verify what is actually enabled in your own environment.
Backups and recovery
- Backup configuration: Gather a summary of the systems and data included, the backup destination, and the schedule or status information your provider makes available.
- Job history and alerts: Save recent backup activity records and note any failures, unresolved warnings, or gaps in coverage. A configured backup is not the same as proof that recent jobs completed successfully.
- Restore-test record: Document when a restore was tested, what data or system was included, who performed the test, the outcome, and any follow-up work. If a test has not been performed or documented, do not imply that recovery has been verified.
- Recovery information: Keep the relevant recovery procedures and responsibilities current, and make sure the people expected to use them can locate them.
If you are reviewing backup coverage or recovery readiness, Zevonix has additional guidance on choosing a backup solutions provider and small-business disaster recovery planning.
Security controls and system records
- Endpoint and security tools: Collect available management reports or configuration summaries that show which business devices are covered and whether the relevant protection is active.
- Updates and maintenance: Keep records of update status, maintenance activity, and any known systems that are out of date or no longer supported. Make the scope clear.
- Network and remote access: Gather current diagrams or configuration summaries where available, along with a list of approved remote access methods and the people or roles authorized to use them.
- Staff practices: Locate current security training records or written procedures if the form asks about them. Do not treat a policy as proof that every staff member completed training.
NIST’s Cybersecurity Framework 2.0 Small Business Quick-Start Guide can help organize how your business identifies and documents cybersecurity practices. Use it as a planning aid, then answer the renewal form according to its exact wording.
Policies, incident response, and changes
- Incident response plan: Keep the current approved plan, its owner, and records of any review or exercise. Check that contact and escalation details remain usable.
- Related policies: Gather the versions of relevant access, acceptable-use, backup, and data-handling policies if the questionnaire asks about written procedures.
- Incident history: Review internal incident records and the renewal period carefully. If asked about events, follow the form’s wording and the broker’s or insurer’s instructions when determining what must be reported. Do not guess or omit information because an event seemed minor.
- Material changes: Note changes since the last renewal, such as new systems, vendors, locations, remote access arrangements, or changes in security coverage. Check whether those changes affect earlier answers.
For Northeast and Central Florida businesses seeking general cyber security resources, the Florida SBDC cyber security page is a local resource to explore. Requirements can differ by insurer, industry, and the systems a business uses.
Compare every answer with the evidence
Before signing or submitting the application, review each security answer alongside the supporting record. Check that both refer to the same systems, users, and time period. For example, an MFA setting for staff email may not establish that MFA is also active for remote access or privileged accounts.
Mark any uncertainty for follow-up with the person responsible for IT, your provider, or your broker. Distinguish clearly between a control that is active, one that covers only part of the environment, and one that is planned but not yet in place. If records conflict, resolve the discrepancy before attesting to an answer.
Keep a copy of the completed application and the evidence index with your renewal materials. Share supporting documents only as requested, using a method approved by the insurer or broker. Ask them if you are unsure what to provide or how to handle a question that does not match your setup.
Frequently asked questions
How can a business prove MFA is enabled?
Use current settings or coverage reports from the relevant systems, and identify the accounts and access methods included. Note exceptions instead of assuming one MFA setting covers every account or service.
What backup records should be ready?
Gather backup configuration and job history, relevant alerts, and a record of restore tests. The records should make clear which systems or data are included and whether recovery was actually tested.
What if a control is planned but not yet active?
Describe its status accurately and do not present a planned change as an existing protection. Ask your broker or insurer how to answer the form when a control is incomplete or does not fit the available choices.
Should evidence be sent with the application?
Follow the insurer’s or broker’s instructions. Keep your evidence organized, but provide only what they request and use their approved method for sharing it.
Make renewal preparation part of routine security work
Clear, current records help your business answer renewal questions consistently and identify gaps that need attention. Zevonix provides managed IT, cybersecurity, backup and disaster recovery, and support for businesses in Northeast and Central Florida. To discuss organizing IT and security records, contact Zevonix at (904) 658-0777.