The 90-day pre-renewal checklist

Why ninety days before renewal is the practical planning horizon

Cyber insurance renewals rarely fail because teams ignore security entirely. They fail because proof arrives late — MFA exports requested three days before bind, backup test logs nobody ran, EDR coverage reports stuck in a vendor portal. Ninety days is the smallest window that reliably covers identity verification, MSP coordination, and broker packaging without fire drills.

This guide splits pre-renewal work into three thirty-day buckets. Each bucket has outcomes, not vague intent. Adjust pacing if your renewal date moves, but keep the separation: foundation first, evidence second, submission polish last.

Callout: The ninety-day clock starts when you have a draft application themes list, not when the broker says “due Friday.”

Day 1–30: Foundation and honest inventory

Week 1–2: Application archaeology

Pull last year’s bound application, endorsements, and any remediation letters carriers sent mid-term. Diff this year’s draft questionnaire against prior answers. Flag any control where architecture changed: new HR system, MFA vendor swap, MSP transition, hybrid work policy, or cloud migration.

Deliverables:

• Side-by-side change log (themes added, removed, or reworded)
• List of owners: identity, endpoints, backups, email, IR
• Broker call scheduled with questions, not attachments

Week 2–3: Draft crosswalk v0

Build the first crosswalk with harsh honesty. Assign Verified, Cannot prove, or Missing without waiting for perfect artifacts. Every Missing or Cannot prove row gets a next action and named owner.

Identity themes usually dominate weight. If you operate Microsoft 365 or Google Workspace, plan read-only verification rather than screenshot collections.

Week 3–4: External perimeter pass

Run external checks on primary domains: SPF, DMARC, DKIM presence, TLS expiry, HSTS, baseline headers. Fix quick DNS and redirect issues you control. Log vendor-managed items instead of hiding them.

Deliverables by day thirty:

• Crosswalk v0 published internally
• External appendix started (even if incomplete)
• Renewal project channel with broker + MSP looped

Use the fit check during this bucket to translate questionnaire themes into prioritized gaps your leadership understands.

Day-by-day anchors (bucket one)

• Day 3: Owner list confirmed; calendar holds for verification window
• Day 7: Last-year vs this-year diff complete
• Day 14: Crosswalk v0 reviewed by IT lead; no Verified without attachment plan
• Day 21: External scan scheduled on primary mail domains
• Day 28: Broker sync — share three-state counts, not raw files

Day 31–60: Evidence collection and verification

Week 5–6: Identity and logging exports

Schedule read-only verification windows for cloud identity. Collect Conditional Access or 2SV enforcement signals, MFA registration coverage, and admin role assignments. Recompute crosswalk rows only after exports land — no manual promotions.

Parallel track: ensure unified audit logging is enabled where carriers expect sign-in and admin activity retention. Logging gaps often surface as Cannot prove even when MFA is strong.

Week 6–7: Endpoint and backup artifacts

Request structured reports from MSP or internal IT:

• EDR deployment counts versus employee census
• Server vs workstation coverage split
• Backup success/failure summaries
• Last restore test ticket with outcome and date

If restore tests are verbal only, schedule a timed test in this bucket. Cannot prove on backups is a common underwriter follow-up — plan the test before they ask.

Week 7–8: Policy and human controls

Gather IR plan with carrier notification contacts, training completion rosters, privileged access review evidence, and vendor inventory for critical SaaS. Signatures and dates matter more than page count.

Deliverables by day sixty:

• Crosswalk v1 with primary artifacts linked per theme
• Identity themes verified where read-only access allows
• MSP/vendor PDFs indexed, not dumped

Review fictional deliverable density on sample report if your team has never seen a submission-ready pack.

MSP and vendor coordination tips

Send vendors a single ticket template listing required report fields: as-of date, scope, deployment counts, and retention settings. Vague “send cyber stuff” requests bounce between tiers and miss renewal deadlines.

If MSP contracts exclude evidence pulls, negotiate a one-time export fee early in bucket two — waiting until day eighty-five forces rush fees or blank rows.

Identity verification window

Read-only consent should be scheduled when global admin availability is confirmed. Avoid change freezes the same week unless necessary. After ingestion, reconcile automated statuses with reality — break-glass accounts and service principals often explain Cannot prove rows that automation flags.

Day 61–90: Submission packaging and exception handling

Week 9–10: Broker alignment

Send brokers a three-state summary, not a zip bomb. Include:

• Counts of Verified / Cannot prove / Missing
• Planned remediation dates for material Cannot prove rows
• Explicit corrections if application answers must change downward

Brokers can advocate when they understand gaps early. Surprises at bind erode trust.

Week 10–11: Application reconciliation

Update the carrier form to match crosswalk reality. Downgrading an answer is uncomfortable; it is cheaper than a post-incident representation dispute. Attach the evidence index with one primary document per row and short cover note explaining scope.

Callout: If a Cannot prove row cannot close before bind, document compensating controls and timeline in the cover note — silence reads as misrepresentation.

Week 11–12: Dry run and re-scan

Re-run external scan if DNS, mail, or hosting changed during the sprint. Internal reviewers should ask: “If I were an underwriter, which row would I click first?” Fix labeling before submission, not after follow-up.

Deliverables by day ninety:

• Final crosswalk with human sign-off
• Broker-ready indexed pack
• Calendar reminder for mid-term evidence refresh

Final fourteen-day checklist

• Crosswalk statuses match attachments opened spot-check
• Application PDF answers reconciled to Missing/Cannot prove rows
• Cover note lists compensating controls for open gaps
• Broker confirms carrier-specific index format (some markets want tabular, others narrative)
• Leadership aware of any downward corrections before they appear in email to underwriter

Roles and RACI (lightweight)

A accountable, R responsible, C consulted, I informed — adjust to your size; solo IT shops wear multiple hats.

Risk triggers that compress the timeline

Start earlier than ninety days if any apply:

• Prior carrier remediation letter outstanding
• MSP or identity platform change in last six months
• Material acquisition or divestiture
• First-time cyber purchase (no prior crosswalk)
• Industry class with heightened ransomware scrutiny

Add fifteen to thirty days for vendor report latency.

Integrating free readiness tools in bucket one

Many teams start with a lightweight questionnaire before paid verification. Scores and band labels help executives see priority, but bands are not crosswalk states. Translate quiz gaps into crosswalk rows explicitly — “amber on MFA” becomes Cannot prove until exports arrive. Re-run the questionnaire after major fixes only for messaging, not as proof.

Brokers benefit when clients attach the gap summary alongside the crosswalk v0 so everyone references the same theme names.

Metrics that matter for leadership

Track progress with simple counts, not vanity scores:

• Verified themes with dated primary artifacts
• Cannot prove themes with committed close dates
• Missing themes with remediation budget approved
• External scan critical findings closed or documented

Heat map color can motivate; state counts predict submission friction.

What not to do in ninety days

• Do not fabricate Verified rows to “look ready”
• Do not postpone backup tests until after bind
• Do not assume marketing site TLS covers payroll workflows on other domains
• Do not let perfect be the enemy of indexed honesty — brokers can work with dated plans if labeled Cannot prove

Mid-term maintenance

After bind, schedule quarterly crosswalk refreshes for identity and backup themes. Major cloud changes should trigger out-of-cycle verification. Renewal then becomes incremental rather than a annual panic.

Closing perspective

Ninety days is a project plan, not a product promise. It aligns technical work with broker timelines so evidence keeps pace with representations. Buckets one and two create truth; bucket three communicates truth. Teams that run this cadence spend less time in underwriter email loops and more time on controls that actually reduce loss frequency.

Begin gap prioritization with fit check, verify identity themes when ready, and see full deliverable examples at sample report. Program overview: Cyber Ready.