Free cyber readiness scorecard
How do your client's cyber controls look to an underwriter?
Twelve questions every cyber insurer asks. Score them, see the gaps to close before applying, then send the client a branded scorecard.
Example figures. Change them to your client's.
1The twelve questions insurers ask
If you are not sure, say so. An underwriter would treat it as a no.
Multi-factor sign-in on email and remote accessMust have
Does everyone need a second step (an app or a key, not just a password) to get into email and to connect from outside the office?
2How it maps to Cyber Essentials
Cyber Essentials covers five areas. Insurers ask about more, backups and incident response in particular.
- Multi-factor sign-in on email and remote access. Cyber Essentials: user access control
- Backups kept offline and tested. Cyber Essentials does not cover backups; insurers ask anyway
- Endpoint detection and response. Cyber Essentials: malware protection
- Critical patches within 14 days. Cyber Essentials: security update management
- Admin rights kept to a few. Cyber Essentials: user access control
- Email filtering and link checks. Cyber Essentials: secure configuration
- Phishing training and tests. Not a Cyber Essentials control; insurers ask anyway
- A written incident response plan. Not a Cyber Essentials control; insurers ask anyway
- No open remote desktop. Cyber Essentials: firewalls
- Logs kept and watched. Supports incident response and reporting
- No unsupported software. Cyber Essentials: security update management
- Suppliers' access controlled. Cyber Essentials: user access control
Scores 68 out of 100 with an underwriter.
Expect questions
Cover is likely, but the insurer will want detail and may set tighter terms.
Underwriter's notes
- Are backups offline or immutable, and when was a restore last tested?
- How quickly are critical vulnerabilities patched on internet facing systems?
- How often do staff receive security awareness training and phishing simulations?
- Is there a tested incident response plan?
- Are security logs centrally collected and monitored?
Gaps to close, most important first
- PartlyBackups kept offline and tested. Keep one copy offline or immutable and test a full restore at least twice a year. Write down how long it took.
- PartlyCritical patches within 14 days. Set a 14 day target for critical patches, 48 hours for internet facing systems with known exploits.
- NoPhishing training and tests. Run short training each year and a practice phishing email each quarter.
- NoA written incident response plan. Write a one page plan with names and numbers, including the insurer's breach hotline, and walk through it once a year.
- Not sureLogs kept and watched. Keep sign-in and security logs for 90 days or more, and have someone (or a service) review alerts.
- PartlySuppliers' access controlled. List every supplier with access, require MFA and turn access off when it isn't in use.
Got the insurer's proposal form? Send it to the client as a chat with a free trial
What to tell your client
On the questions cyber insurers ask, your business scores 68 out of 100: expect questions. Closing the top gaps, starting with backups kept offline and tested, will help on price and terms.
Illustrative only, not advice. The policy wording and the insurer decide. Nothing you type leaves your browser unless you make the PDF.
Why it matters
Most businesses are attacked. Fewer than half are insured
43%
of UK businesses had a cyber breach or attack in the last year.
DSIT Cyber Security Breaches Survey 2025/2647%
have any cyber cover, and 22% don't know whether they do.
DSIT Cyber Security Breaches Survey 2025/26£197m
paid by insurers on UK cyber claims in 2024, more than three times the year before.
ABI, cyber claims paid in 2024
In plain English
Why the proposal form matters so much
Cyber insurers price on controls, not just turnover. The answers decide the premium, the excess and sometimes whether a claim is paid.
Some controls are must haves
Multi-factor sign-in, offline backups and endpoint detection. Without them many insurers decline or exclude ransomware.
Not sure means no
An underwriter treats an answer nobody can stand behind as a gap. Ask the IT provider before the form goes in.
A wrong yes can cost a claim
If a control was said to be in place and wasn't, the insurer may reduce or refuse a claim. Honest answers are the safe ones.
What underwriters look for
Three groups of controls, in the order insurers care about them
Proposal forms differ, but the questions behind them are the same everywhere. Get the first group right and the rest is negotiation.
Must haves
Without these many insurers decline or exclude ransomware. They are the first questions on every form.
- Multi-factor sign-in on email and remote access
- Backups kept offline and tested
- Endpoint detection and response
Expected
Missing these leads to follow up questions, higher excesses or sub-limits.
- Critical patches within 14 days
- Admin rights kept to a few
- Email filtering and link checks
- No open remote desktop
Good practice
These improve terms and make a claim smoother to handle.
- Phishing training and tests
- A written incident response plan
- Logs kept and watched
- No unsupported software
- Suppliers' access controlled
A quick game
Spot the phish
Phishing is behind most attacks on businesses. Tap the part of each email that gives it away.
Email 1 of 3. Tap the giveaway.
From accounts@riverside-supplies.example
Updated bank details for this month's invoice
How brokers prepare a cyber placement
Three steps before the proposal form
- 1
Run the twelve questions early
Two or three months before renewal leaves time for the client to close a gap, which costs less than the premium it saves.
Marsh, twelve key cyber controls - 2
Get evidence, not ticks
Screenshots of MFA settings, a backup restore log, the EDR console. Insurers increasingly ask for proof.
- 3
Point clients at Cyber Essentials
Only 5% of businesses hold it, yet certified firms are far less likely to claim. It is a cheap, recognised way to show the basics are covered.
NCSC Annual Review 2025
The client PDF
A scorecard the client can hand to their IT provider
Your logo and details, the readiness score, the underwriter's view and each gap with what to do about it. It turns a proposal form into a to do list.
- Readiness score and verdict
- Gaps ranked by what insurers care about
- What the insurer will ask
- Mapping to Cyber Essentials
How your cyber controls look to an insurer
68/100
Expect questionsGaps to close
- ☐ Backups kept offline and tested
- ☐ Critical patches within 14 days
- ☐ Phishing training and tests
- ☐ A written incident response plan
Test yourself
What do cyber underwriters really ask? Five questions
The proposal form decides the price, the terms and sometimes whether a claim is paid. See how well you know what is behind it.
Which control do almost all cyber insurers now insist on before they quote?
Questions brokers ask
Cyber readiness, answered
- Is this the same as an insurer's proposal form?
- No. Each insurer has its own form, but they ask about the same controls. This scorecard prepares the client so the real form is quick and accurate.
- How is the score worked out?
- Each control carries a weight for how much underwriters care about it. Yes scores the full weight, partly half and no or not sure nothing. A missing must have control caps the verdict whatever the score.
- Does it map to Cyber Essentials?
- Yes. Each control shows the Cyber Essentials area it relates to. Insurers ask about more than Cyber Essentials covers, backups and incident plans in particular.
- Should my client get Cyber Essentials?
- It is a good start and some insurers reward it. Only 5% of UK businesses hold it, according to the government's breaches survey.
- Does this guarantee cover?
- No. It shows how the controls are likely to be seen. Each insurer sets its own requirements and the final decision is theirs.
- Is my client's data stored?
- No. The scorecard runs in your browser. Answers only leave it if you make the PDF.
With a free trial
Send clients the questions, get the answers back filled in
Coverbound turns any insurer's proposal form into a chat your client can finish on their phone, then fills in the PDF. 14 days free, no card.
Find the gaps before the underwriter does
Twelve questions, five minutes, one scorecard to send.
More free tools