The short answer
Every insurer and policy differs, but applications and renewal questionnaires commonly ask about:
- MFA on email, remote access, admins
- EDR, and who monitors it
- Separated, tested backups
- Scheduled patching, no exposed unsupported systems
- Awareness training, often phishing simulations
- A tested incident response plan
- Call-backs for supplier bank changes
A policy is one part of a risk strategy, not a replacement for cyber resilience.
Why the answers matter more than they used to
The questionnaire is not paperwork to rush: answers shape whether and on what terms you are covered, and policy wording may refer back to them. Underwriters ask about security audits, access safeguards and data handling, and strong risk management generally earns more reasonable terms. Insurers in Nigeria are regulated by the National Insurance Commission (NAICOM); products and terms vary, from local insurers or brokers with access to international markets.
Tick "MFA on all remote access", suffer a breach through a VPN account without it, and claim time gets difficult.
The controls, and what "yes" should really mean
| Control | What "yes" should mean |
|---|---|
| MFA | Every user, not most: shared mailboxes, service and break-glass accounts, third-party support access. CISA and others favour phishing-resistant options such as FIDO keys, and number matching against MFA fatigue (MFA rollout guide). |
| EDR and monitoring | Installed and answered: insurers increasingly ask who responds. Servers and Macs are often missed; know who acts at night (managed EDR vs DIY). |
| Backups | Offline or immutable copies, separate credentials, encryption, restore tests. A "success" report is not proof you can recover: record the last full restore's date and result. UPS or inverter on backup devices, so outages do not corrupt running jobs. |
| Patching | How fast critical updates land; unsupported systems retired, or isolated and documented. |
| Privileged access | Separate admin accounts, few holders, MFA on all. |
| Email and payments | Filtering, SPF, DKIM, DMARC; bank detail changes confirmed by phone on a number you already hold. Bank transfers are very hard to recall, so this carries real weight. |
| Training and planning | Last training cycle and incident response exercise, with dates and attendance. |
ngCERT is Nigeria's national point for cyber incident reporting and advice: decide now who would contact it, and the insurer, after an incident.
Frameworks behind these questions
The NIST Cybersecurity Framework and CISA's #StopRansomware guidance, widely used as international good practice, line up closely with these questions.
Rather talk it through? If your renewal questionnaire is on someone's desk right now, we can verify the answers and gather the evidence with you. Talk to a Promatics specialist
Build an evidence pack before renewal
Brokers and underwriters ask better questions every year; a short evidence pack saves time and cuts the risk of a wrong answer.
Cyber insurance evidence pack
- MFA enrolment report for all users and admins, exceptions explained
- Devices and servers with EDR; who monitors alerts after hours
- Backup design summary; date and result of last full restore test
- Patch compliance report; unsupported systems and their compensating controls
- Privileged accounts and who holds them
- SPF, DKIM and DMARC status for each domain
- Payment change verification procedure
- Training records and phishing simulation summary
- Incident response plan with the date of the last exercise
- Contacts: IT provider, counsel and the insurer's breach line
Keep it current: it also answers security questionnaires from large clients or a bank.
What usually goes wrong
Answering from memory
Someone remembers turning MFA on, not that a group of users was excluded.
Licences, not controls
You own an EDR licence, but the agent never reached the servers.
Last-minute changes
MFA forced on the day before renewal: lockouts, then exceptions nobody removes.
Forgotten suppliers
Your IT provider's or software vendor's remote access counts too.
When to bring in help
A small environment with a clear-headed IT person can gather most of this from existing admin consoles. Bring in a professional when answers are uncertain or inconsistent, the insurer has declined, added exclusions or asked for controls you lack, gaps must close in weeks, or you want someone accountable for the evidence.
A chatbot can explain a questionnaire; it cannot check your tenant, confirm server coverage or stand behind the answer. A Promatics security assessment reviews how you are really set up, ranks the gaps and gives you evidence and a remediation plan in plain language.
Limitations
Requirements vary and change; this describes commonly asked controls in general terms, not insurance or legal advice. We do not predict whether any insurer will offer, renew or pay: discuss coverage and wording with your broker.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- #StopRansomware Guide, Cybersecurity and Infrastructure Security Agency (CISA)
- Cybersecurity Framework, National Institute of Standards and Technology (NIST)
- ngCERT (Nigeria Computer Emergency Response Team), Federal Government of Nigeria
- National Insurance Commission (NAICOM), NAICOM
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.