Applying for cyber liability insurance means answering a detailed questionnaire about your security posture — and for a SaaS company that hasn't been through the process before, it can be the least familiar part of getting covered. Here's what underwriters are actually asking, and why.
The Core Categories
Cyber underwriting questionnaires vary by carrier, but they consistently cover the same handful of categories:
- Access controls: Do you require multi-factor authentication for employee and administrative access? How is privileged access managed and reviewed?
- Data protection: Is customer data encrypted at rest and in transit? How is sensitive data classified and segmented?
- Backup and recovery: How often are backups taken, where are they stored, and have recovery procedures actually been tested?
- Monitoring and detection: Do you have endpoint detection and response tooling in place? How quickly would you detect unauthorized access?
- Incident response: Is there a written incident-response plan, and has your team run through it?
- Employee training: Do employees receive regular security awareness training, particularly around phishing?
- Vendor and subprocessor risk: How do you vet the security posture of third-party services and subprocessors your product depends on?
Why the Questions Have Gotten More Specific
Cyber underwriting has moved well past a short checkbox form. Insurers responding to a rising volume of ransomware and breach claims now ask pointed, specific questions rather than broad yes/no items — expecting evidence, not just assurances, for the controls that matter most.
Where SOC 2 Fits In
A current SOC 2 Type II report doesn't replace the questionnaire, but it overlaps with it substantially. SOC 2 independently tests many of the same controls underwriters ask about — access management, encryption, monitoring, incident response — over a defined audit period, rather than relying on a company's own self-reported answers. Having a recent SOC 2 report ready as supporting documentation can make the underwriting conversation move faster, since much of the evidence underwriters would otherwise have to ask about piece by piece is already assembled in one place. It's not a requirement for coverage, but it's a genuine advantage in the process.
Getting Ready Before You Apply
The fastest way through underwriting is having the following organized before you start:
- A written incident-response plan (even a simple one, if you don't have a mature security program yet)
- Documentation of your MFA policy and where it's enforced
- A summary of your backup and recovery process, including how recently it was tested
- Your SOC 2 report, if you have one, or a summary of security controls if you don't
We Can Help You Prepare
SaaS Coverage, a division of Contractors Choice Agency (founded 2005), works with software companies to match cyber liability coverage to their actual security posture and help them walk into underwriting prepared. Call 844-967-5247 or request a quote online to get started.