What underwriters actually check (and what they only think they check)

Why the questionnaire and the evidence are two different conversations

Cyber insurance renewal season compresses months of IT work into a short application window. Your broker forwards a carrier questionnaire; someone on your team checks boxes about MFA, backups, EDR, and patch cadence. Underwriters then ask a follow-up that sounds simple but rarely is: show us proof.

That gap — between what you believe is true and what you can demonstrate on demand — is where submissions stall, endorsements get trimmed, and post-incident reviews get painful. Carriers are not grading your intentions. They are scoring evidence quality against control themes that repeat across markets: identity, endpoint protection, logging, backup integrity, vendor management, and incident readiness.

Callout: A completed questionnaire is a narrative. A crosswalk is a map from each answer to an artifact, an export, or an explicit gap.

What underwriters actually weight

Most SME cyber applications cluster around a familiar set of controls. Weighting varies by carrier and line, but the questions converge:

• Multi-factor authentication on email, VPN, and admin consoles — not just “enabled for some users”
• Endpoint detection and response or managed AV with central visibility
• Immutable or logically separated backups with tested restore evidence
• Patch and vulnerability management cadence for internet-facing and critical systems
• Email security (filtering, anti-phishing, DMARC alignment where applicable)
• Privileged access limits, logging, and review
• Incident response contact tree and carrier notification steps

Underwriters treat these as baseline hygiene, not optional extras. What separates a smooth renewal from a back-and-forth is whether your answers line up with artifacts a technical reviewer can validate without a live interview.

The crosswalk: one row per control theme

A crosswalk lists each control theme the carrier cares about, your stated posture, the evidence you can attach, and a clear status. Mature programs use three states (covered in depth in our companion piece on verification):

• Verified — read-only telemetry or exports support the claim
• Cannot prove — you operate the control, but proof is weak, stale, or self-attested only
• Missing — control not in place or not scoped as required

Without a crosswalk, brokers forward PDFs in random order and underwriters reconstruct the story themselves. That reconstruction is where “we thought MFA was everywhere” meets “sign-in logs show exceptions.”

Sample crosswalk shape (illustrative)

This table is fictional but mirrors the deliverable shape we use in client work. Seeing a filled example helps teams understand density and honesty — carriers prefer explicit gaps over silent optimism.

Review the full fictional sample — crosswalk, heat map, and 90-day roadmap — on our sample report page.

Cannot prove vs Missing: why the distinction matters

Teams often collapse “we’re working on it” into a single bucket. Underwriters do not.

Missing means the control is absent, out of scope, or not credibly operated. Examples: no EDR on workstations, backups that have never been restored, or MFA disabled for legacy break-glass accounts without compensating controls.

Cannot prove means the control may exist operationally, but your evidence chain is thin: a policy PDF without configuration exports, a vendor invoice without deployment statistics, or an admin’s attestation without logs. Cannot prove is not a moral failure — it is an auditability problem you can fix before submission.

Callout: Treat “Cannot prove” as a work queue, not a shame label. Each row should have a next action: export, ticket, or scope correction.

Silent promotion is the dangerous habit: marking Verified when the best you have is a checkbox on last year’s form. That pattern shows up in denial conversations after an event, when forensic timelines disagree with the application.

Questionnaire tactics that backfire

Common mistakes we see on SME renewals:

• Copy-paste from last year without checking whether MFA enforcement, EDR coverage, or backup architecture changed
• Answering “yes” based on policy rather than production configuration
• Hiding exceptions (shared admin accounts, unmanaged devices, personal email for finance workflows)
• Overloading the broker with unrelated security PDFs instead of a indexed evidence pack

Underwriters appreciate concise, indexed packages. A one-page cover note that explains scope — what was verified read-only, what is self-attested, what is open — saves weeks.

Building evidence without oversharing

Read-only verification for Microsoft 365 or Google Workspace can lift identity and logging themes into Verified without granting mail or file access. Endpoint and backup proof usually comes from your MSP, EDR vendor, or backup console — export coverage summaries, restore test tickets, and change records.

Start with the carrier’s own themes. Map each to one primary artifact. If you need a second document, explain why in the index row. Duplicative screenshots of settings pages add noise, not confidence.

Where self-attestation still fits

Early-stage readiness work is often self-attested by necessity. Free questionnaires and broker briefs can help you prioritize before you pay for deeper verification. The upgrade path is deliberate: replace attestation with exports where carriers draw hard lines — MFA registration, DMARC DNS, backup test logs, EDR deployment counts.

If you are unsure which themes are Cannot prove versus Missing today, run the structured fit check and review gaps before your broker submits.

Practical pre-renewal sequence

1. Inventory last year’s application and this year’s draft side by side.
2. Draft a crosswalk even if statuses start harsh — honesty reduces surprise.
3. Collect exports for the top five weighted controls your broker names.
4. Reconcile exceptions (legacy protocols, shared creds, unmonitored devices).
5. Package with a cover note; link to your evidence index rather than attaching mystery files.

How underwriters sequence technical review

Review queues are not random. Carriers typically start with identity and email because impersonation and fund-transfer fraud drive severity. Next they examine endpoint visibility and EDR, then backup and recovery, then logging and IR. If your pack front-loads marketing PDFs while MFA proof is buried, you inherit delay.

Expect follow-ups phrased as yes/no but answered with documents: “Confirm MFA on all admin accounts” becomes a registration export request. “Describe backup immutability” becomes a vendor architecture diagram or console screenshot with dates. Preempt those asks by ordering your index the way reviewers read.

Working with brokers on theme mapping

Brokers translate carrier jargon into tasks your IT team recognizes. Share the carrier’s theme list early — not only the PDF checkboxes. Map each theme to a system owner: Entra ID or Google Admin for identity, RMM/EDR portal for endpoints, backup SaaS for restore tests, DNS host for DMARC.

When brokers request “anything cyber,” resist sending policies alone. Send the crosswalk row for that theme, the status, and the attachment name. Brokers can forward a coherent story; they cannot invent exports you never collected.

After the underwriter follow-up

Remediation letters mid-term are second applications in disguise. Treat them as crosswalk updates: change statuses, attach fresh artifacts, and note dates in the cover letter. Carriers track whether follow-up evidence matches the original representation. Consistency matters more than polish.

Closing perspective

Underwriters are specialized risk analysts, not adversaries. They respond to clarity, consistency, and corroboration. When your questionnaire answers, crosswalk statuses, and artifacts tell the same story, you spend less time in remediation loops and more time negotiating coverage terms you actually understand.

For the visual reference of how Verified, Cannot prove, and Missing appear in a submission-ready PDF, visit Cyber Ready sample report. For program overview and service boundaries, see Cyber Ready home.