A cyber insurance application is, in practice, a security questionnaire. The Insurance Bureau of Canada (IBC) publishes a free self-assessment that it says poses some of the same questions business owners see on an application, and describes it as a way to learn about the cyber security protocols and best practices that most cyber insurers look for when assessing risk. Its ten questions cover your cyber risk, whether you collect and store customers’ personal information, what security procedures you have, and how often employees get cyber safety training.
The short answer, then: before you apply, get multifactor authentication on everything, backups you have actually restored from, current patching, endpoint protection on every device, email filtering, controlled admin accounts, staff training and a written incident response plan — and be able to produce dated evidence for each. IBC reports that enhanced underwriting practices now require stringent cyber security controls, and the answers you give are part of the contract.
What cyber insurance covers
IBC says stand-alone cyber insurance policies, written specifically for cyber risks, are the most common cyber policies in Canada, the United States and Europe, and that endorsements — also called riders — can be added to traditional commercial policies to add limited cyber coverage. A rider on your existing business policy is not the same product as a stand-alone policy, and it’s worth knowing which one you’re being offered.
IBC groups the risks cyber insurance can address into three categories:
- Data confidentiality breaches — the loss of, unauthorized access to, or disclosure of confidential or personal information.
- Cyber extortion — a demand for payment under threat of causing harm to your data, such as disabling your operations or compromising confidential data.
- Technology disruptions — a technology failure or denial-of-service attack.
On costs, IBC points to legal and civil damages, security breach remediation and notification, forensic investigation, and computer program and electronic data restoration, and notes that policies may include access to breach response teams made up of forensic investigators, legal counsel and public relations specialists, along with business interruption and recovery costs.
The Cyber Centre’s baseline cyber security controls make the same point from the buyer’s side: consider a policy that includes coverage for incident response and recovery activities in addition to liability coverage. A policy that only pays third-party claims doesn’t help you get the business running again.
First-party and third-party cover
Policies are usually built from separate insuring agreements, and it helps to sort them into two groups before you read any wording.
First-party covers your own losses: the forensic investigation, rebuilding systems and restoring data, the cost of notifying affected people, income lost while you’re down, and extortion-related costs where the policy responds to them. Third-party covers claims made against you by other people — customers, suppliers, partners — including legal defence and damages, and any regulatory process that follows.
Most small-business losses are first-party. A ransomware event that closes a trades company for a week costs payroll, lost jobs and recovery labour long before anyone sues. So read the first-party side closely: how business interruption is measured, when the clock starts, how long it runs, and whether data and system restoration is a separate agreement with its own limit.
Two things are worth asking about specifically. First, sub-limits: an insuring agreement can carry a lower ceiling than the policy limit, so a policy described as “$1 million” may respond to some losses for far less. Second, social engineering and funds transfer fraud — the case where nobody hacks anything and an employee is tricked into sending money to a fraudulent account. Ask whether that loss is covered at all, whether it sits in a separate agreement, what sub-limit applies, and what verification steps the policy expects you to follow. IBC notes that insurers have been clarifying coverage areas, refining policy wordings and explicitly excluding cyber warfare and state-sponsored attacks, so wordings are moving.
The controls application forms ask about
The control areas below are the ones IBC’s self-assessment and the Cyber Centre’s baseline both point at. Treat this as the work list, not just the form.
Multifactor authentication
The question is rarely “do you have MFA.” It’s where. The Cyber Centre says to use MFA wherever possible, and specifically for financial accounts, system and cloud administrators, other privileged users and senior executives. Its 2024 guidance strongly recommends phishing-resistant methods such as FIDO-based ones, number matching, and limits on repeated sign-in prompts. Check remote access and any admin portal, not just email.
Backups and tested restores
Having backups and having proven restores are different answers. The baseline requires backups of essential business information, encrypted, with access limited to the people who restore them, and says long-term backups such as weekly ones must be stored offline. The Cyber Centre’s ransomware playbook goes further: keep two or more backups offline, test them on a regular schedule such as monthly, and scan a backup for malware before restoring from it. Our backup and disaster recovery guide covers what a real restore test looks like.
Endpoint protection
Forms often use the term EDR — endpoint detection and response — which watches for suspicious behaviour on a device rather than only matching known malware. The Cyber Centre lists installing anti-virus, anti-malware and EDR software among basic cyber security best practices. The answerable version of the question is: on how many of your devices, updating automatically, and who watches the alerts.
Patching and supported software
Turn on automatic updates for all software and hardware, including routers and other network devices, and replace products that no longer receive updates. Unsupported operating systems are a visible weakness on an application — Windows 10 and Office 2016 and 2019 reached end of support on October 14, 2025.
Email filtering and domain protection
Filter incoming and outgoing mail, and implement DMARC. The Cyber Centre says complete email protection needs SPF, DKIM and DMARC together, configured to tell recipients to reject inauthentic messages, and that domains you don’t send mail from should be protected too.
Privileged account control
Give each person their own account with only the access their job needs, use admin accounts for admin work only — not email or web browsing — and remove accounts that are no longer needed. The Cyber Centre’s guidance on administrative privileges adds MFA for every admin account and removing special privileges once they aren’t needed. Offboarding belongs here too.
Training and phishing
Train staff on passwords, spotting malicious emails and links, approved software, and safe internet use. The Cyber Centre’s phishing guidance adds simulations and a clear internal process for verifying and reporting suspicious messages. Teach people to confirm unusual requests — new banking details especially — through a separate channel they already know.
Incident response plan
Write down who handles an incident and how to reach outside help, stakeholders and regulators, keep a current printed copy for when systems are down, name a backup contact for each person, and test and revise the plan every year. “We would call our IT provider” is not a plan, and it reads as one on a form.
Mapping the questions to the Cyber Centre’s baseline
The Cyber Centre’s baseline sets out 13 controls for organizations with fewer than 500 employees. Working through them in order answers most of an application, which is why we treat the two jobs as one.
| What the form asks about | Baseline control |
|---|---|
| Incident response plan, and who you call | 1 — Develop an incident response plan |
| Patching and unsupported software | 2 — Automatically patch operating systems and applications |
| Anti-malware and EDR coverage | 3 — Enable security software |
| Default passwords and device hardening | 4 — Securely configure devices |
| MFA, password rules, privileged users | 5 — Use strong user authentication |
| Staff training and phishing simulations | 6 — Provide employee awareness training |
| Backups, encryption, offline copies, restore tests | 7 — Back up and encrypt data |
| Phones, tablets and personal devices | 8 — Secure mobility |
| Firewall, Wi-Fi, remote access, email filtering, DMARC | 9 — Establish basic perimeter defences |
| Cloud services and your IT provider’s access | 10 — Secure cloud and outsourced IT services |
| Website and customer-facing systems | 11 — Secure websites |
| Least privilege, admin accounts, offboarding | 12 — Implement access control and authorization |
| USB drives and portable media | 13 — Secure portable media |
Our small business cybersecurity checklist walks through all 13 in order with the Cyber Centre’s current advice on each.
Answering accurately, and what happens if you don’t
Application forms are written in absolutes. “Yes” means for every user, on every system, today — not “mostly,” “on email,” or “we’re getting to it.” The gaps that come up most often:
- MFA on Microsoft 365 or Google Workspace but not on remote access, the firewall, or the accounting system;
- backups that run and are monitored, but have never been restored from end to end;
- an offline or immutable copy claimed when every copy is reachable from the same network and the same admin account;
- endpoint protection counted on managed laptops but not on the owner’s personal computer;
- a plan for staff training that hasn’t happened yet.
If you can’t answer yes, answer no and describe the plan with dates. Insurers price risk; an accurate no with a remediation schedule is a workable conversation, and an inaccurate yes is a problem waiting for a claim.
BC’s Insurance Act sets the general rule in section 17(1): a contract is not rendered void or voidable by a misrepresentation, or a failure to disclose, “unless the misrepresentation or failure to disclose is material to the contract.” The Act also sets out statutory conditions that form part of contracts insuring property, the first of which deals with misrepresentation. Materiality is a real threshold and not a safe harbour — and remember that after an incident a forensic investigation reconstructs what was actually running, so the facts on the file will be the facts.
The documentation to keep
Every claim on the form should have something dated behind it. Gather these once, then refresh them on a schedule — most take minutes to export.
Evidence to keep for a cyber insurance application
- An MFA enrolment report or export showing which accounts are covered, with the date it was produced.
- A list of every system reachable from outside the office and how each one is authenticated.
- Backup job reports for the last few months, showing what is backed up and how often.
- Restore test records: the date, what was restored, how long it took and who did it.
- Evidence of an offline or immutable backup copy and who can delete it.
- A patch compliance report and a list of any unsupported operating systems or applications still in use.
- Endpoint protection coverage — devices protected against devices owned — and who receives the alerts.
- Your published SPF, DKIM and DMARC records, and the DMARC policy you are enforcing.
- An inventory of administrator accounts, who holds them, and the date they were last reviewed.
- Training completion records and phishing simulation results, with dates.
- The incident response plan, dated and version-numbered, with a record of the last test.
- A list of vendors and IT providers with access to your systems, and what access each one has.
Keep a copy somewhere that survives an outage. The Cyber Centre asks for an up-to-date printed copy of the incident response plan for exactly this reason; the same logic applies to your insurer’s contact details and policy number.
Questions to ask your broker
- Is this a stand-alone cyber policy or an endorsement on an existing commercial policy?
- Does it cover incident response and recovery costs, or only liability?
- Which insuring agreements carry sub-limits, and what are they?
- How is business interruption measured, when does it start, and how long does it run?
- Is social engineering or funds transfer fraud covered, and on what terms?
- Who chooses the incident response firm, and must we use a panel?
- What are we required to notify you about, and how quickly?
- What documentation will you want after an incident, and can we prepare it now?
- What is excluded — and how are cyber warfare and state-sponsored attack exclusions worded here?
- Does anything in the policy depend on controls we have to keep in place for the whole term?
Getting ready before you apply
A workable order for a small business with a few weeks before renewal:
- Inventory users, devices and cloud services, including anything an owner or contractor uses for work.
- Turn on MFA for admin, cloud and financial accounts first, then everyone else, then remote access.
- Fix the backups, add an offline or immutable copy, and run a real restore test with a stopwatch.
- Get endpoint protection onto every device and confirm it’s updating.
- Replace or isolate unsupported software, and turn on automatic updates everywhere else.
- Publish SPF, DKIM and DMARC, and move DMARC toward a reject policy.
- Split admin accounts from daily accounts and review who holds what.
- Run staff training and a phishing simulation, and record who completed them.
- Write the incident response plan, print it, and test it once.
- Then complete the application, with the evidence beside you.
One more thing to settle in advance: your reporting obligations don’t come from the policy. BC’s Personal Information Protection Act requires reasonable security arrangements but, as of October 2026, doesn’t require breach notification; federal PIPEDA does require reporting breaches that create a real risk of significant harm. Cyber incidents can also be reported to the Cyber Centre, and fraud to the RCMP’s National Cybercrime and Fraud Reporting System. Our cybersecurity checklist covers the breach steps BC’s privacy commissioner recommends.
YVR Technology helps businesses across Greater Vancouver and the Fraser Valley close the gaps an application exposes and produce the evidence behind the answers. See our cybersecurity service and managed IT services, or get in touch.