Cyber insurance: what will the insurer ask before covering you?
The insurer wants to know whether you have the basic protections in place: multi-factor authentication, regular backups kept separately, threat detection on your computers, a crisis plan and a record of past incidents. It asks its questions in writing, and your answers are binding: a deliberately false answer makes the policy void. Before you sign, check every ‘yes’ and gather the proof that goes with it.
Why the insurer asks so many questions
You don't take out cyber insurance the way you take out fire insurance. Before covering your business, the insurer wants to know whether the basic protections are in place. To an insurer, an SME with no backups and no multi-factor authentication is a risk it turns down or charges dearly for.
Assuralia (in French), the Belgian federation of insurance companies, sums up what insurers look at before covering a business. The list is short, but each point needs proof, not a gut feeling.
On price, Assuralia mentions premiums that often range from a few hundred to a few thousand euros, depending on the risk and the protections already in place, with excesses of the same order. The price is usually set case by case: your answers have a direct impact on the premium.
The six points the insurer looks at
| What the insurer checks | What it means, in plain terms | What you need to be able to show |
|---|---|---|
| Multi-factor authentication | On top of the password, a code or an approval on your phone to sign in | The list of protected accounts: email, remote access, admin accounts |
| Regular backups, kept separately | A copy of your data in another place, which an attacker inside your network cannot delete | How often copies are made, and the date of the last successful restore test |
| Threat detection on computers (EDR, MDR) | Software that spots suspicious behaviour, not just known viruses; with MDR, a team watches the alerts for you | How many computers and servers are covered, and who receives the alerts |
| Claims history | Incidents you have already had: viruses, a hacked mailbox, payment fraud | A dated list, with what has been fixed since |
| Crisis or business continuity plan | Who does what on the day everything stops, and how the business keeps running | A short, up-to-date document with the numbers to call |
| Agreement to an independent audit | Accepting that a third party checks, for example against the CCB's CyberFundamentals framework | A recent self-assessment, or a report from an accredited body |
The CCB is the Centre for Cybersecurity Belgium, the public body in charge of the country's cybersecurity. According to the CCB, around 80% of cyberattacks are made possible by carelessness or human error (a figure quoted by Assuralia). So expect a question on staff training as well.
The ‘yes’ answers that don't hold up
The trap is not the question, it is the answer given too quickly. Before ticking ‘yes’, check these common cases:
- Multi-factor authentication ‘everywhere’, except on the reception's shared mailbox, a former employee's account or the administrator's. A single forgotten account is enough to make the answer inaccurate.
- The cloud backup that is only a sync: if ransomware (a program that encrypts your files and then demands a ransom) damages a file, the damaged copy is synced as it is. A real backup keeps older versions, out of the attacker's reach.
- The backup that has never been tested: until you have restored a folder, you don't know whether it works.
- Antivirus presented as threat detection: traditional antivirus and a detection and response tool do not do the same job. Ask your IT provider what is actually installed.
- The crisis plan that lives in the manager's head: if it isn't written down, it doesn't exist as far as the insurer is concerned.
Your answers are binding: what the law says
In Belgium, the Insurance Act of 4 April 2014 (in French) is clear. Article 58 requires you, when you sign, to disclose accurately everything you know that matters to the insurer in assessing the risk. The written questionnaire is the practical form of that duty.
| Situation | What the law provides |
|---|---|
| Deliberately false answer or concealed information (Article 59) | The policy is void. The insurer keeps the premiums due up to the moment it discovers the omission. |
| Unintentional mistake, discovered before any claim (Article 60) | The policy remains valid. The insurer proposes to amend it within a month, or cancels it if it proves it would never have covered that risk. |
| Unintentional mistake you cannot be blamed for, claim in the meantime | The insurer must provide the agreed cover. |
| Mistake you can be blamed for, claim in the meantime | The insurer only pays in proportion to the premium paid compared with the premium you should have paid. If it proves it would never have covered that risk, it only refunds the premiums. |
Two useful points. If a written question is left unanswered and the insurer signs anyway, it cannot rely on that later, except in case of fraud (Article 58). And during the policy, Article 81 requires you to report changes that increase the risk significantly and lastingly. If you stop your external backups, for example, tell your broker.
An example
Example, made up for illustration. A services company of around twenty people fills in the questionnaire in ten minutes, between two meetings. To the question ‘Is multi-factor authentication enabled for all users?’, the manager ticks ‘yes’. He had it switched on last year, but the shared accounts mailbox was left out, so as not to block the invoicing software.
Eight months later, an attacker gets in through that very account. While investigating the claim, the insurer's loss adjuster spots the gap. The question becomes a legal one: deliberate omission or honest mistake? At best, the payout is negotiated; at worst, the policy is challenged. Ten minutes of checking before signing would have avoided the argument.
What a cyber policy covers, and what to check
According to Assuralia, a cyber policy for businesses can combine several parts:
- Your own losses: business interruption, analysing and rebuilding data, IT specialists and consultants called in urgently, and possibly administrative fines.
- Your liability to others: if your customers or partners suffer harm, including defence costs.
- Assistance: technical help, communication, crisis management and protecting your reputation.
- The ransom: help with negotiating and paying, a part the insurer does not always grant.
Payment fraud (the fake supplier, the fake boss) is not necessarily in the cyber policy: Assuralia advises considering separate fraud cover. Read the exclusions and limits before comparing prices.
After an attack: the reflexes that protect your payout
- Notify the insurer or broker as soon as possible, and in any case within the deadline set in the policy (Article 74 of the Act). Put the policy's assistance number in your crisis plan.
- Limit the damage: the law asks you to take all reasonable steps to prevent and mitigate the consequences of the loss (Article 75). Follow the policy's assistance instructions to isolate the affected machines.
- Keep the evidence: screenshots, messages received, the time you found out. The insurer's loss adjuster will need them.
- Notify the Data Protection Authority (DPA) if personal data is affected: where possible within 72 hours of discovery, unless the breach is unlikely to pose any risk to people. Notification is made via the DPA's page on data breaches.
If you do not meet these obligations and the insurer suffers a loss as a result, it can reduce its cover by the amount of that loss. In case of fraudulent intent, it can refuse cover altogether (Article 76).
CyberFundamentals: proof the insurer can read
Rather than answering each questionnaire your own way, you can rely on a recognised framework. The CCB created CyberFundamentals (CyFun), a list of measures grouped by level. The ‘Basic’ level has 34 measures. According to two CCB officials, when fully applied, they block 82% of the real incidents analysed (Belgian Financial Forum, May 2024).
The same authors point out that a simple self-assessment carries little weight: it is verification by an accredited body that gives a reliable picture of the risk, notably to insurers. A self-assessment is still a good starting point to see where you stand. Free tools for Belgian businesses, including a self-assessment questionnaire, are gathered on Safeonweb@work.
Your plan for Monday morning
- Ask your broker for the insurer's questionnaire before the meeting, not on the day you sign.
- Have a list drawn up of every account, including shared and technical ones, and spot those without multi-factor authentication.
- Have a folder restored from the backup, and note the date and the result.
- Ask your IT provider what actually protects your computers: traditional antivirus or a detection tool, and who receives the alerts.
- Write down the incidents of the last few years, even minor ones, with what was fixed.
- Draft a one-page crisis plan: who to call, in what order, with the insurer's assistance number.
- Keep a copy of the signed questionnaire and the proof: if you ever make a claim, that is your file.
Prepare your cyber insurance file→
Frequently asked questions
Does an SME have to take out cyber insurance?
No, no law requires it. It is useful if several days of downtime or rebuilding your data would cost more than you can absorb: Assuralia advises insuring the amounts you could not reasonably pay yourself. It does not replace protections: the insurer requires them before covering you.
What happens if I answer ‘no’ to a question on the questionnaire?
An honest ‘no’ does not put you at fault: the insurer adjusts the premium, sets conditions or declines to cover you. The problem is a false answer. If deliberate, it makes the policy void (Article 59 of the Act of 4 April 2014); if unintentional, it can reduce the payout (Article 60).
How much does cyber insurance cost for an SME?
According to Assuralia, premiums often range from a few hundred to a few thousand euros, depending on the risk and the protections in place, with excesses of a few hundred to a few thousand euros. The price is usually set case by case, based on your answers.
Is the ransom reimbursed after a ransomware attack?
Only sometimes: according to Assuralia, the ransom is not always covered. Read the clause with your broker. The real protection is still a tested backup kept separately, which lets you restart without depending on the attacker.
Does CyberFundamentals lower the premium?
No public scale guarantees it. But Assuralia lists the CCB's CyberFundamentals audit among what the insurer may ask for, and the CCB presents it as a reliable picture of the risk, notably for insurers. So it is a strong argument in the negotiation.
Do I have to report an incident that happened before signing?
Yes, if the questionnaire asks for it or if it is information that matters to the insurer (Article 58 of the Act). Claims history is one of the points Assuralia mentions. Deliberately hiding it exposes you to the policy being void.