The renewal questionnaire your insurer sends is the most honest assessment of your security program that most companies receive all year, and it arrives whether or not anyone is ready for it.
I have filled these out, and I have watched what happens when the answers get assembled the week they are due. The questions themselves are not hard to understand. They are hard to answer honestly when nobody has been made responsible for the control underneath them, and that is the part a renewal exposes.
The questionnaire is an audit wearing different clothes
Insurers stopped asking whether you take security seriously several years ago. They now ask whether specific controls exist, where they apply, and how you know. Multifactor authentication on email and remote access. Privileged accounts that are individually assigned. Backups that someone has restored from, not just written to. An incident response plan a team has actually practiced.
Each of those is a yes-or-no question with a paper trail behind it, which is what makes it an audit. The difference is in what you get back. A regulator hands you a finding and a remediation window. An insurer hands you a price.
Where the cost actually lands
The premium is the visible part, and it is rarely the expensive part.
- Sublimits. Coverage for the loss types most likely to reach you, such as ransomware, funds transfer fraud and business interruption, is often capped separately. Weak answers push those caps down.
- Higher retention. You keep more of the first dollar of a loss, and that lands in the same quarter as the incident itself.
- Conditions and warranties. Coverage can be made contingent on a control you said was in place.
- The attestation. Someone signs the questionnaire. If an answer turns out to have been optimistic at the moment of a claim, that signature becomes the problem rather than the control.
The last one deserves more attention than it usually gets. The person signing is often the one with the least direct visibility into whether a control is operating everywhere it was described, and nobody set out to put them in that position. It happens because the questionnaire arrives as paperwork rather than as an audit.
The four answers that move the number most
Across the renewals I have been part of, the same four areas do most of the work.
- Multifactor coverage, stated precisely. Not that you have MFA, but which systems, which accounts, and what the exceptions are. Service accounts and legacy protocols are where the real exposure tends to sit, and an insurer who finds them later remembers finding them.
- Privileged access. Shared administrative accounts are one of the most common findings and one of the cheapest to fix. Individually assigned privileged accounts turn an incident from “someone” into a name.
- Recovery you have tested. A backup nobody has restored from is a plan rather than a control. One documented restore test changes the answer and, more to the point, changes how honest the answer is.
- Incident response with names in it. A plan that names roles, a call list that is current, and one tabletop in the last year. Insurers ask because rehearsed responses cost them less, which is also why they cost you less.
The ninety days before a renewal
The work here is not large, and starting early is most of what makes it inexpensive.
- Ninety days out. Pull last year’s questionnaire and answer it honestly, in private, with nothing riding on it. Every answer that comes out as “yes, mostly” is a project rather than an answer.
- Sixty days out. Close what can genuinely close in eight weeks. Multifactor gaps and shared administrative accounts usually can. A full identity program usually cannot, and deciding that early is better than discovering it late.
- Thirty days out. Write down what remains open, why, and the date it closes. Insurers respond considerably better to a dated plan than to a silence they have to interpret.
None of this requires a new tool. Most of it requires one person owning the answers before the deadline owns them instead.
What the renewal is really telling you
Here is the part worth keeping. The questionnaire is a free, externally validated read on your security posture, written by people who lose money when they are wrong about you. That is a better assessment than most organizations pay for, and it shows up once a year without being asked for.
So if the answers turn out to be hard to produce, that is information about the program rather than about the paperwork. It is uncomfortable information, and it is also the most useful thing the renewal gives you.
If your renewal falls inside the next two quarters and you are not sure how the answers will read, now is the right time to look. A Security Maturity Snapshot produces a scored position and a sequenced list of what to close first, which is most of what a good renewal file is built from. Send me your renewal date and I will tell you what is realistic to close before it.