What Underwriters Ask For Now (Evidence, Not Theater)
What cyber insurance questionnaires ask small practices about MFA, backups, and EDR, and the evidence a practice admin should have ready before signing.
Every year the same email lands. Your broker sends the cyber insurance policy renewal application, pages of yes and no questions, and asks for it back by Friday. Do you require MFA for remote access? Are backups tested? Is endpoint detection and response on every device?
Most practices answer from memory. Someone checks yes, the owner-physician signs, and the form goes back. The form gets the answers. It rarely gets proof.
This post is for practice admins, office managers, and owner-physicians at outpatient clinics without an enterprise security team. For most of you, the cyber insurance policy renewal sets the security clock more often than any board risk committee ever will. So it is worth knowing what the questions are really asking.
Why the questionnaire matters more than it looks
The application is how a carrier learns what controls you have. Carriers use questionnaires to decide which controls they expect to see. The Corvus by Travelers policyholder dashboard, for example, uses questionnaires that identify controls required for renewal eligibility (Travelers).
Two things make the form heavier than it looks. First, the practice signs the answers. Not the MSP, not the broker. Second, the bar keeps moving. Having a control is no longer the whole question; how far it reaches matters too (more on that below).
Here is the honest part. A questionnaire full of yes answers is not a security program. It is a description of one. The job is making sure the description is true.
The controls underwriters keep asking about
In a 2022 guide, Marsh, the insurance broker, grouped the controls cyber insurers commonly require into 12 categories (Marsh). Here are eight of them, in plain terms for a small practice:
- 1Multi-factor authentication (MFA). A second step at login for email, the EHR, remote access tools, and every admin account. Marsh says MFA should cover remote access, privileged and admin access, and access to critical or sensitive data. Evidence to have ready: a list of every account and system with MFA status, plus admin console screenshots.
- 2Secured, encrypted, and tested backups. Copies the attacker cannot reach, and proof they restore. Marsh recommends isolating backups from the network or protecting them with MFA and encryption, and testing them regularly. Evidence to have ready: the date and result of the last restore test, and where the backup copy lives.
- 3Endpoint detection and response (EDR). Software that watches each computer for suspicious behavior and can stop it. Evidence to have ready: a console export showing every workstation and laptop covered, not most of them.
- 4Privileged access management. Fewer admin accounts, each tied to a named person. Evidence to have ready: a current list of admin accounts and who owns each one.
- 5Email filtering and web security. Blocking phishing and malicious links before staff see them. Evidence to have ready: the name of the filtering service and a settings screenshot from your MSP.
- 6Incident response planning and testing. A written plan that says who calls whom when something goes wrong, and proof someone walked through it. Evidence to have ready: the plan, plus notes from the last tabletop or walkthrough.
- 7Patch and vulnerability management. Updates applied on a schedule, with exceptions tracked. Evidence to have ready: a recent patch report from your MSP.
- 8Security awareness and phishing training. Staff who know what a fake invoice or password reset email looks like. Evidence to have ready: completion records with dates.
The other four on Marsh's list (hardening, protection for end-of-life systems, logging and monitoring, and vendor risk) matter too.
The bar is moving as well. More recent Marsh McLennan research found that simply having MFA no longer sets an organization apart, because few lack it. What matters now is the type of MFA (whether it resists phishing and bypass) and how fully it is enforced. The same research found EDR delivers more of its benefit when it covers all workstations and laptops (Industrial Cyber on the Marsh McLennan study).
Evidence, not theater
Theater is a yes with nothing behind it. Evidence is a yes with an attachment.
A generic online checklist, a questionnaire score, or an IT vendor template can make a practice feel ready. None of them will hold for counsel, a broker, or a payer when someone asks to see it. Because the practice signs the application, a yes you cannot back up becomes a hard conversation later with your broker or carrier.
The fix is not complicated. For each control question, ask one thing: what would we show if someone asked? If the answer is a screenshot, a log, or a dated record, keep it in one folder. If the answer is "I think the MSP handles that," that is the gap.
Picture next year's questionnaire coming back from your broker answered in one email, every yes with its attachment.
What a practice admin can check 90 days before the cyber insurance policy renewal
You do not need to be technical to start.
- 1Pull last year's application and read every question you answered yes. Mark the ones where you are not sure.
- 2Ask your MSP for a list of every account with admin rights, and whether each one has MFA turned on.
- 3Ask for the date of the last backup restore test and what was restored. "Backups run nightly" is not the same answer.
- 4Ask whether EDR is on every workstation and laptop, including the front desk machines and the one in the back office nobody uses.
- 5Find your incident response plan. If no one can find it in five minutes, that is your answer.
Related: cyber insurance policy renewal readiness and Front Desk Security Is Program Security.
How this connects to a HIPAA Risk Assessment
The HIPAA Security Rule requires covered entities (and their business associates) to conduct an accurate and thorough assessment of the risks to electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)). If your cyber insurance application asks whether you have a current one, this is the document behind that yes.
A HIPAA Risk Assessment for a typical single-site outpatient practice is a remote engagement over 2 to 4 weeks. Harborline senior practitioners interview your team, review configurations and policies, and produce a written inventory of risks plus a ranked remediation plan. Much of the evidence a HIPAA Risk Assessment gathers (MFA, backups, access, incident response) is the same evidence the cyber insurance policy renewal application asks about, so the work counts twice. More on scope: HIPAA Risk Assessment for outpatient practices.
Typical single-site fee: fixed fee, scoped on a short call. Details: HIPAA risk assessment cost.
Practices that want the evidence kept current between cyber insurance policy renewals often move to the Harborline Annual Security Program, fixed fee, scoped on a short call (one annual reassessment, four quarterly check-ins, async Q&A capped at 4 hours per quarter). Compare options: one-time assessment vs Annual Security Program.
Harborline ranks the findings and verifies the evidence. Your IT contact or MSP does the hands-on work. Harborline never fills out or signs the insurance application, and does not sell insurance or promise premium or coverage outcomes. Your broker places coverage.
Situation card (anonymized, pattern-based)
A small outpatient clinic. The practice had answered yes to "Do you require MFA for remote access?" for years. During a HIPAA Risk Assessment, the evidence showed MFA on email but not on the remote access tool the billing contractor used, and not on an old admin account set up during the original EHR install. Nobody had lied. The answer had simply drifted from the truth. The gap was ranked near the top of the remediation plan, the MSP closed both items, and the next questionnaire answer was true and backed by a screenshot.
Frequently asked questions
- 1What if we cannot show evidence for a control we answered yes to? Talk to your MSP first and find out what is actually in place. Then talk to your broker before you sign, not after. An honest "partial, fix scheduled" is a better answer than a yes you cannot support.
- 2Will Harborline fill out our cyber insurance application? No. Harborline never fills out or signs the application. The practice signs its own attestations. Harborline helps you know what is true and what evidence exists.
- 3Our MSP says we are covered. Is that enough? Your MSP implements the controls, and its word is a good start. The application still asks the practice. Ask the MSP for the screenshots and reports listed above so the answer rests on proof, not memory.
- 4Does a HIPAA Risk Assessment guarantee better coverage or a lower premium? No. Harborline does not promise premium or coverage outcomes. A current HIPAA Risk Assessment gives you a documented picture of your controls and a ranked plan, which is what you need to answer the questionnaire honestly.
- 5Does this help with payer credentialing too? It can. Some payer credentialing security questionnaires ask about similar controls, such as MFA, backups, access, and a current HIPAA Risk Assessment. Where they overlap, one evidence set can serve both.
Book a 30-minute scoping call
Harborline · Contact · harborlinesec.com
Further reading
Front Desk Security Is Program Security
Front desk habits are where outpatient program security shows up day to day: badges, PHI at reception, shared logins, EHR workstations, and MSP handoffs.
HIPAA Risk Assessment for Outpatient Practices
A plain-language guide to HIPAA risk assessments for small outpatient clinics. What it covers, how long it takes, and what happens after.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.