Questions to ask before your cyber insurance renewal

Build a shared picture before comparing prices

Invite the people who understand operations, security, finance, and insurance to contribute to one short renewal brief. Describe what changed during the expiring term: new services, acquisitions, additional personal information, changed technology providers, or greater dependence on a single system. Give the broker enough context to ask targeted follow-up questions.

Our recommendation is to distinguish confirmed facts, estimates, and unresolved questions. A statement such as “the provider is investigating this” is more useful than an unsupported assurance. Keep the evidence behind application answers so the person signing can review them.

Check the application against reality

Travelers’ public forms library includes a renewal application and separate supplements, including multifactor authentication and social engineering. These are examples of insurer-specific information gathering, not a universal application that every business must satisfy. Obtain the forms that actually apply to your proposed coverage.

Ask your technical team to explain the scope of each answer. A control used for employee email may not extend to administrator accounts, remote access, outsourced support, or every subsidiary. If an application question is ambiguous, request clarification before answering.

Add a proportionate quantum-readiness update

NIST’s migration project emphasizes discovering cryptographic dependencies and preparing for transition. Translate that into a modest business update: who owns the work, which data need long-term confidentiality, which providers have been contacted, and where important unknowns remain.

You do not need to invent a completion percentage. Describe milestones with evidence, such as an approved inventory scope or a written vendor response. Ask whether the underwriter requests particular information; do not assume a roadmap guarantees eligibility, favorable pricing, or a policy extension.

Compare the contract, not only the limit

Request a renewal comparison that identifies changes to coverage wording. Use the same realistic event to discuss both the expiring and proposed contracts. A lower price does not by itself tell you whether the retained financial exposure has changed.

• Have any exclusions, endorsements, definitions, or reporting conditions changed?
• Are important outsourced providers included within dependent-business-interruption provisions?
• Which costs have separate sublimits, waiting periods, retentions, or coinsurance?
• How do privacy liability, operational interruption, social engineering, and technology E&O fit together?

Practice the first call after a suspected incident

Ask who should call the insurer and how the team can access policy details if normal systems are unavailable. Confirm the current incident hotline, how approved specialists are engaged, and which expenses need consent. Put those instructions in the response plan using secure offline access where appropriate.

Discuss a tabletop scenario in which a supplier cannot operate and your organization cannot immediately tell whether its own data were affected. Agree on who gathers facts, who coordinates legal advice, and who handles notification. This exercise exposes practical gaps without making a coverage prediction.

Leave with owners and open questions

End the meeting with three lists: items the broker will clarify, controls the technical team will validate, and business decisions leadership must make. Record due dates and the person responsible. Keep application accuracy separate from aspirational improvement plans.

This guide is a suggested review process for US business insurance discussions. Exact underwriting requirements, reporting duties, policy availability, and legal treatment vary. Your issued wording and professional advice should resolve the details; a generic online checklist cannot do that work.