Signing With Evidence: A Director’s Routine for Cyber Insurance Attestations

The form is not the risk

A cyber insurance proposal is often handled by whoever manages the broker relationship, completed in a hurry before renewal, and signed by a director who has had little sight of the underlying controls. That is an understandable administrative pattern. It is also increasingly unsafe. Insurers now ask for statements of fact about multi-factor authentication coverage, patch cadence, backup restoration testing and privileged access. Those statements can be relied upon at claims stage, sometimes years after the policy was bound.

The practical issue is not whether the organisation has a good story. It is whether the story can be demonstrated. A director signing an attestation is not being asked to express confidence in the IT team. They are being asked to confirm that defined controls exist, operate across a defined estate, and are evidenced in a way that would survive scrutiny. That is a control question before it is an insurance question.

Why the questionnaire deserves a proper owner

Most organisations treat the cyber questionnaire as a procurement artefact. It sits alongside the broker’s covering email and the renewal schedule, and it is completed by someone with access to a handful of system reports. The weakness in that approach is structural: the person completing the form may know the answers, but the board is accountable for the attestation.

A better model is to assign the questionnaire to a named director or executive committee, supported by an evidence pack. The pack does not need to be elaborate. It needs to be current, reproducible and aligned to the questions that carry the most weight. Once that discipline exists, the questionnaire becomes a free annual control audit rather than a form to be rushed.

The eight questions that usually matter most

Most UK cyber questionnaires vary in wording but converge on a small set of controls. The following are the areas where inconsistent answers create the greatest claims risk.

Multi-factor authentication coverage. The question is rarely whether MFA exists. It is where it is enforced, which user groups are exempt, and how exceptions are approved. A single legacy application outside the scope can undermine a blanket assurance if the insurer later asks for the coverage map.

Patch cadence and exception handling. Insurers want a defined standard, not a heroic effort. If critical vulnerabilities are remediated within fourteen days, the evidence should show the policy, the tracking mechanism and the approved exceptions. A missed target is less damaging than an undocumented process.

Backup restoration testing. Having backups is not the same as being able to restore. The attestation should reflect actual restoration tests, including scope, frequency, success criteria and the date of the last exercise. A backup dashboard is not a restoration record.

Privileged access management. Who holds administrative rights, how those rights are granted, how they are reviewed and how they are removed are all relevant. Standing administrator accounts are a common weak point between what the organisation believes and what the directory actually shows.

Endpoint protection coverage. The insurer may ask what proportion of endpoints are covered by the deployed protection and how gaps are identified. The answer should come from a report, not an assumption about device management.

Incident response arrangements. A plan that has never been exercised is a document, not a capability. Insurers increasingly ask about testing, roles and escalation routes. A tabletop exercise record is usually sufficient evidence, provided it names participants and actions.

Third-party and supplier controls. Where critical services are outsourced, the organisation still needs a view of the supplier’s security posture and contractual notification obligations. The questionnaire may ask about material suppliers, not every supplier.

Board reporting and ownership. Finally, insurers may ask who owns cyber risk at executive level and how the board receives assurance. A named owner and a minuted reporting rhythm are simple, credible evidence.

Building the evidence routine

The most efficient routine starts with the prior year’s questionnaire. Extract each assertion that requires a yes or no, then map it to an evidence source and an owner. This produces a short evidence register rather than a library of policies. For each control, record the question asked, the answer given, the source of evidence, the date it was produced and the person accountable for its accuracy.

Where evidence is missing, do not smooth the answer. Either the control is not in place, or the evidence has not been captured. Both are useful findings. The director’s attestation should reflect the position that can be demonstrated, with any material gaps disclosed in the appropriate place. An honest qualified answer is generally safer than an unqualified answer that cannot be supported.

A useful discipline is to run the exercise six to eight weeks before renewal. That leaves time to close small evidence gaps, correct inaccurate directory reports and brief the signatory. It also prevents the annual scramble in which the questionnaire is completed from memory and signed without a supporting pack.

The board minute that earns its keep

When the attestation is presented for signature, the board or audit committee should minute four things: the controls covered by the questionnaire, the evidence reviewed, any exceptions or qualifications, and the owner responsible for maintaining the evidence until the next renewal. That minute is not bureaucracy. It is the record that shows the signatory acted on evidence rather than assumption.

A short pre-signature checklist helps:

• Has each material assertion been mapped to a named evidence source?
• Are MFA, patching, backup restoration and privileged access supported by current reports rather than policy statements?
• Have exceptions been documented, approved and disclosed where required?
• Has the signatory seen the evidence pack, not just the completed form?
• Is there a named owner for keeping the evidence current?
• Has the board or committee minuted the basis on which the attestation was signed?

A useful annual discipline

Cyber insurance is not a substitute for controls, and an attestation is not a guarantee that a claim will be paid. But the questionnaire is one of the few annual moments when an organisation is forced to describe its controls in specific, testable terms. Treated as a control audit, it exposes gaps while there is still time to address them. Treated as an administrative form, it creates a paper trail that may later contradict the organisation’s own systems. The difference lies in whether the signature is supported by evidence.