The managing partner of a 25-person accounting firm in Mississauga opens the renewal questionnaire for the firm's cyber insurance. Question 7: "Is multi-factor authentication required for all remote access?" She ticks "yes." Everyone uses an authenticator app for email, after all.
Except the outside IT technician still connects to the server through an old remote desktop setup protected by a password alone. If ransomware ever comes in that way, that ticked box could become the centre of the conversation with the insurer.
A cyber insurance questionnaire is not paperwork. It is a declaration the insurer relies on to accept your risk, and it is also the best free security checklist you will receive this year.
TL;DR
- Insurers ask about the same core controls: MFA, EDR, offline or immutable backups, patching, training and an incident response plan.
- An inaccurate answer can seriously affect your coverage: insurance law in Québec and elsewhere in Canada imposes a duty to disclose material facts.
- Check every answer against consoles and reports, not memory, and fix quick gaps before you sign.
- Keep your answers true all year: a new tool or a new IT provider can change the reality.
Why the questions got so detailed
A few years ago, cyber insurance was sold with barely any questions. Ransomware claims changed that. Insurers now want to know precisely whether the controls that stop those attacks are actually in place.
The amounts involved explain the caution. According to industry data cited by Insurance Business Canada (October 2025), average costs reach $330,000 for a ransomware incident, $220,000 for a data breach and $118,000 for funds transfer fraud. Yet according to a 2025 Coalition study, 77% of Canadian small businesses believe they are too small to be targeted.
Beyond technology, insurers also look at your profile: headcount, types of clients, and the nature and volume of the information you keep. The less unnecessary data you hold, the smaller your exposure.
The controls insurers almost always ask about
Wording varies from one insurer to the next, but the themes repeat. Here are the main ones, with the trap we see most often in small businesses.
| Control | What the insurer wants to know | The common trap |
|---|---|---|
| Multi-factor authentication | Email, remote access, admin accounts, backup console | A forgotten VPN, remote desktop or service account |
| EDR (endpoint detection and response) | Deployed on every workstation and server, and monitored | Traditional antivirus only, or alerts nobody reads |
| Offline or immutable backups | Separated from the main network, tested regularly | A copy on a NAS reachable with the same admin account |
| Patch management | Time to apply critical patches, end-of-life systems | The old server "that runs the accounting software" |
| Employee training | Frequency, phishing simulations | One session at onboarding, then nothing |
| Incident response plan | Written, current, tested | A document nobody has opened since it was written |
| Email and payment security | Filtering, payment verification procedure | No call-back before changing a supplier's banking details |
| Privileged accounts | Separate, limited admin accounts | Every employee is a local admin |
If one row makes you hesitate, good: you have found your priority. For MFA, our guide to choosing multi-factor authentication explains why SMS codes are no longer enough. For backups, the 3-2-1-1-0 rule directly answers the insurer's question about offline or immutable copies.
Some questions catch owners off guard. Insurers may ask whether a specific person is responsible for privacy or information security, how you vet IT vendors that have remote access to your systems, and whether you could keep operating if your main systems were down for several days. None of these require a big budget. Each one does require a clear, honest answer, and someone in the business who owns it.
Answer honestly: what the law expects
In Québec, the Civil Code (art. 2408 and following) requires the policyholder to disclose known circumstances that could materially influence the insurer's assessment of the risk. Misrepresentation or concealment can allow the insurer to seek annulment of the contract, and even without bad faith, the indemnity can be reduced. Elsewhere in Canada, provincial insurance law and the common law impose a similar duty to disclose material facts.
In practice, three simple rules:
- A "partial yes" is a "no." If MFA covers almost every access but not all of it, answer no and explain in the comments what remains and when it will be fixed.
- Never answer on behalf of your IT provider. If they manage your servers, have them confirm each technical answer, in writing.
- Keep a signed copy. The questionnaire often forms part of the contract.
The exact consequences of an error depend on the facts and on your policy wording. If a question seems ambiguous, check with your broker or legal counsel before you sign.
A five-step method
- Ask for the questionnaire early. Several weeks before renewal, not the day before.
- Get the right people in the room. Leadership, whoever owns IT and, if applicable, your managed service provider.
- Verify each answer at the source. Open the MFA console, the EDR dashboard, the backup report. Memory is optimistic.
- Fix the quick wins before signing. Enabling MFA on a forgotten access path or isolating a backup copy often takes less time than negotiating with an insurer.
- Document. Add clear comments to any "no" answer, with a realistic timeline.
If the gap is too wide to close before the deadline, our remediation and hardening service can prioritize the fixes that weigh most in the questionnaire.
Checklist: evidence to gather
- MFA console report showing enrolled users and exceptions.
- List of remote access paths (VPN, remote desktop, remote support tools) and how each is protected.
- EDR report: number of devices covered and the date of the last alert handled.
- Log of your most recent backup restore test, with the date.
- Patch report and list of end-of-life systems.
- Training records and results of your latest phishing simulation.
- Incident response plan, with the date of its last review.
- Written procedure for verifying payments and changes to banking details.
After you sign: keep your answers true
The questionnaire describes your situation on a given date. But small businesses change: a new remote support tool, a new IT provider, an employee who installs a file-sharing app.
Make a habit of rereading your answers every quarter, or whenever a significant change affects your remote access, backups or IT provider. If a control you declared is no longer in place, fix it quickly and talk to your broker.
Finally, insurance does not replace your legal obligations. If an incident involves personal information, privacy law may require you to notify a regulator and the individuals concerned: the Commission d'accès à l'information under Québec's Law 25, or the federal Privacy Commissioner under PIPEDA. That applies whether or not you are insured.
Frequently asked questions
Does cyber insurance pay the ransom in a ransomware attack?+
It depends on the policy wording. Some policies cover extortion, usually with conditions and the insurer's prior consent; others exclude or limit it. Paying does not guarantee you get your data back. Ask your broker to show you the exact clause.
Doesn't my general liability policy already cover cyber attacks?+
Rarely in full. In Canada, cyber coverage is most often sold as a stand-alone policy, sometimes adjusted with endorsements. Ask your broker what your current policies exclude, especially funds transfer fraud and notification costs.
Can a cybersecurity audit improve our insurance terms?+
Insurers often ask when your last security audit took place and whether its recommendations were implemented. A recent audit with a tracked remediation plan lets you answer the questionnaire precisely and with evidence. Strong risk management can help you get better terms, but each insurer sets its own criteria.
During an incident, should we call the insurer or our IT provider first?+
Read your policy before anything happens. Many policies require prompt notice to the insurer and provide a breach hotline or a list of approved incident response firms; hiring another firm without consent can limit reimbursement. Put those contacts in your incident response plan.
Sources
- 1.Get Cyber Safe (Insurance Bureau of Canada): Does your small business need cyber insurance?
- 2.Civil Code of Québec, arts. 2408 to 2411 (declaration of risk)
- 3.Canadian Underwriter: Why cyber insurance companies are requiring businesses to use MFA
- 4.Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)
- 5.Canadian Underwriter: Canadian small businesses underestimate cyber risk (Coalition)