A cyber underwriting questionnaire asks a company to describe its information system in forty closed questions, and that description becomes the basis of the contract. It is an exercise without equivalent in other lines: one does not ask a manufacturer to tick that its plant is sound, one goes and looks. Here the insurer will look at nothing, it underwrites on what is declared to it, and the accuracy of that declaration is the only link between the risk priced and the risk carried. The whole difficulty comes from the questions being binary and information systems not being so.
The characteristic defect is almost never a lie, it is one word taken for another. A company declaring two-factor authentication deployed is thinking of the project it launched, of the servers where it works, of the decision taken in committee. The insurer reads complete coverage of all remote access. Between the two lies a real estate where sixty percent of accounts are protected, where providers hold service accounts that were never included, and where two legacy applications cannot do it. Nobody lied and the declaration is false.
One must therefore know who fills in this document, and that organizational point decides everything else. The questionnaire arrives via the broker, lands in the finance department, which passes it to IT, which answers in good faith about what it knows of its own perimeter. Yet an inaccurate declaration binds the company and not the engineer who ticked the box. The protective practice is short: have each technical answer validated by the person who could demonstrate it, and keep the record of that validation. What takes half a day before underwriting is worth the amount of the loss afterwards.
The sanction then depends on two things insureds confuse: the nature of the inaccuracy and its link with the loss. An inaccurate declaration made in good faith opens, under various laws, a proportional reduction computed on the ratio between the premium paid and the one that would have been asked with full knowledge. An intentionally false declaration falls under another and far more severe regime. And some policies add conditions precedent, which turn a declaration into a continuing obligation: if the clause says cover assumes two-factor authentication on all remote access, its absence is no longer a question of proportionality, it is a condition not met.
That distinction between declaration and condition deserves to be looked for in the contract, because it does not show on a quick reading and it changes everything. A declaration describes a state at the date of underwriting. A condition imposes a state throughout the period. An insured that sincerely ticked a box in January, and whose provider disabled the mechanism in June to fix an application, has honored its declaration and breached its condition. The first useful reflex is therefore to identify, among the forty answers, those the contract takes up as conditions, and to put them under watch as one watches a credit limit.
It must be added that the questionnaire ages very fast, faster than in any other line. An information system changes every month: an acquisition adds a whole estate, a migration moves data, a provider is replaced, an application is opened outward for remote work. Many policies require material changes to be declared during the year, an obligation nobody performs because it assumes knowing what material means. One simple rule serves as method: what would have changed an answer to the questionnaire is declared, and nothing else.
The discipline comes to four steps, all preceding signature. Have each question answered by someone able to demonstrate the answer, and keep the record. Translate ambiguous words, deployed, up to date, backed up, into a percentage of estate and a named perimeter, rather than into yes or no. Identify the answers the contract takes up as conditions, and put them under watch. And reread the questionnaire at every organizational change, not out of zeal but because an answer that has become false during the year is exactly what the insurer will look for after the loss.
A 900-employee industrial company takes out cover in January. On the questionnaire, to the question "is two-factor authentication deployed on remote access?", the IT manager answers yes: the project is complete on employee workstations, 780 accounts out of 1,300. The remaining 520 are service accounts, provider access and two production management applications that cannot support it. In September, an attacker enters through a maintenance provider's account, with no second factor. The loss reaches 4.1 million euros. The policy takes that answer up in its special conditions. What happens?
Nobody lied and the insured's position is very poor, which is the typical configuration of these files. The IT manager answered on the perimeter he had in mind, employee workstations, where deployment is real and complete; the insurer read the question as written, all remote access, where coverage is sixty percent. Good faith is certain and it is not enough. What decides here is in fact not the inaccurate declaration regime, which would have opened a proportional reduction computed on the premium gap: it is that the policy took that answer up as a special condition. The distinction is decisive and the insured did not see it. A declaration describes a state at the underwriting date and an inaccuracy is sanctioned by a reduction; a condition imposes a state throughout the period, and its absence is no longer a question of proportionality but a condition not met. Added to this is the most direct causal link there is: the attacker entered precisely through an account without the second factor, that is, through one of the 520 the answer did not cover. What should have been done fits in one line and cost half a day: translate the question into a percentage of estate and a named perimeter, 780 accounts out of 1,300 and here is which, rather than into yes or no. An insurer receiving that figure prices it or sets an explicit condition; it does not discover in September what it should have read in January.
- 01The insurer will look at nothing: it underwrites on what is declared, and that is the only link between the risk priced and the risk carried.
- 02The characteristic defect is not a lie but one word taken for another: deployed does not name the same perimeter on both sides.
- 03A declaration describes a state at the underwriting date; a condition imposes it throughout, and its absence is no longer proportional.
- 04Translate ambiguous words into a percentage of estate and a named perimeter rather than into yes or no: a figure gets priced, a yes gets disputed.
- 05The questionnaire ages fast: what would have changed an answer is declared during the year, and nothing else.