Short answer
A cyber application asks about MFA and backups because those controls address the ways attackers commonly get into small firms. Carriers use the answers to judge risk and decide what to offer. Answer every question accurately. A wrong answer can lead to a denied claim, and a “no” does not always mean a decline. Questions vary by carrier, so this page covers the common ones.
Why the cyber application asks about IT controls
Each question on a cyber liability application usually maps to a way attackers have gotten in at other organizations. The carrier is not testing you. It is checking whether the common doors are closed.
For a first-time applicant, the questions can feel technical. Knowing the reason behind each one makes them easier to answer, and it often helps to have the person who manages your IT nearby.
What the cyber application asks about MFA
Multifactor authentication (MFA) requires a second step, such as a code or approval on a phone, in addition to a password. Applications often ask whether it is turned on for email and for remote access.
The reason is that attackers often test stolen passwords on email, VPN and remote access accounts. SOCRadar’s write-up on one ransomware group, INC Ransom, describes that method. MFA means a stolen password alone is not enough. Phishing-resistant options, such as passkeys or security keys, are stronger still.
If the honest answer is no, turn it on for email first. Many email and file-sharing services include MFA at no extra cost.
What the cyber application asks about backups
Applications typically ask whether backups exist, whether they are kept offline or separate from the main network, and whether a restore has been tested. Ransomware tries to encrypt or delete whatever it can reach, so a backup on the same network may be lost along with everything else.
If the answer is no, a separate or offline backup and a test restore are good first steps. A backup nobody has tested may not work when needed.
What the cyber application asks about patching and EDR
Patching means installing software updates that fix known flaws. Endpoint detection and response (EDR) is security software that watches computers for suspicious activity. Applications often ask about both.
Verizon’s 2026 breach report was widely reported to rank exploited software flaws as a leading way in. Check that figure against the original report before relying on it. If your answer is no, turn on automatic updates and ask your IT provider about EDR. The phishing and IT security checklist covers both steps.
What the cyber application asks about admin rights
Admin rights let a user install software and change settings. If an everyday account has them, an attacker who steals that login gets far more power. Applications often ask who has admin access and whether it is limited.
If too many people have it, restrict it to the few who need it. Most staff can do their work without it.
What the cyber application asks about payment verification
Many applications ask whether the firm confirms new payees or changed bank details by phone. Payment fraud is a common way small firms lose money, and some automated and AI-assisted attacks can make messages look more convincing than before.
If the answer is no, adopt a written callback rule using a number you already have. The rule costs nothing and supports both prevention and a future claim.
Why honest answers matter on a cyber application
Answer every question accurately, even when the honest answer is unflattering. A carrier may rely on your answers when it issues the policy. If an answer turns out to be wrong, it can create problems at claim time, including a denied claim, depending on the policy terms and applicable law.
Never guess or round up. If you are unsure, ask your IT provider or your broker before submitting.
What happens if the answer is no
A “no” does not always lead to a decline. Some carriers may quote with conditions, sometimes called subjectivities. For example, a carrier might offer coverage on the condition that MFA is turned on within a set period. Others may price the risk differently. Outcomes vary by carrier and by the rest of the application.
Real-world example
Consider a hypothetical nine-person architecture firm filling out a cyber application for the first time. The office manager finds that MFA is on for email but not for the remote-access tool. Backups exist, but they sit on the same server as the files.
She answers honestly and asks her broker what that means. The broker explains that a carrier may quote with conditions. The firm turns on MFA for remote access and adds a separate backup. The next application is easier to complete.
What to check before you apply
Firms may want to review:
- Whether MFA is on for email, file sharing and remote access.
- Whether backups are separate from the main network and have been restored in a test.
- Whether automatic updates are on and who owns them.
- Whether EDR runs on every computer.
- Who has admin rights, and whether that list is short.
- Whether a written callback rule exists for payment changes.
Hardcover insight
First-time applicants often worry that a “no” will end the conversation. Usually it starts a useful one. The questions work like a checklist of the most common problems. Fixing even a few before applying often improves the options on the table, and honest answers keep the policy on solid ground.
Related questions
Why does a cyber application ask about MFA?
Attackers often test stolen passwords on email and remote access accounts. MFA adds a second step, so a password alone is not enough.
What happens if I answer no on a cyber application?
A “no” is not always a decline. Some carriers may quote with conditions or price the risk differently. Outcomes vary.
Can a wrong answer affect a claim?
Yes. An inaccurate answer can lead to problems at claim time, including a denied claim. Answer accurately.
Do backups need to be offline?
Applications often ask whether backups are offline or separate from the main network. Ransomware can reach backups stored on the same network.
Do all carriers ask the same questions?
No. Questions vary by carrier. The common ones cover MFA, backups, EDR, patching, admin rights and payment verification.