What to have ready before you apply or renew

Your insurer won’t just ask whether you protect the business — they’ll ask you to prove it. Gathering the evidence below before you apply keeps your quote fast and your price steady. Anything you can’t show works against you, so “not sure” is treated as a “no.”

The questions are pass or fail

Each control you can’t prove can raise your premium or stall the quote entirely.

Proof protects your claim

If you ever have to claim, the insurer can check that what you stated was true. Keep the evidence that backs every answer.

It comes back every year

Gather it once, keep it in one place, and renewal stops being a last-minute scramble.

The eight things to gather

Control	What the insurer wants to see	What counts as proof	Watch out for
Multi-factor login (MFA / 2-step)	A second step — a code or an app approval — to sign in to email, remote access, and admin accounts.	A screenshot of the setting showing the second step is required for everyone, not just available.	Often on for email but missing on remote desktop or an older VPN.
Device protection (EDR)	Modern protection on every computer and server that can detect and stop an attack — ideally monitored.	A screenshot from your security tool showing how many devices are covered and that it’s active. Name the provider if it’s monitored for you.	Basic antivirus isn’t the same thing; servers and personal laptops are often left out.
Backups	Regular backups, with at least one copy kept offline or locked and separate from your main systems.	A screenshot of the backup schedule and the date of your last successful test restore.	Backups that were never test-restored, or the only copy sitting where ransomware could reach it.
Updates & patching	Important security updates applied on a regular, defined schedule.	Your update policy, plus a recent report showing systems are current.	No set schedule, or systems still running software the maker no longer supports.
Email & phishing defense	Spam and phishing filtering, plus email authentication set up on your domain.	A screenshot of your filter settings and a check of your domain’s email records (SPF, DKIM, DMARC).	Authentication missing or turned off; filtering on but staff never trained to spot scams.
Admin access	Admin accounts kept separate, given only to those who need them, with no shared logins.	A screenshot of who holds admin rights, plus your access policy.	Everyday staff accounts carrying admin powers, or a single shared “admin” login.
Incident response plan	A written plan for a breach — who does what, who to call — reviewed in the last year.	The plan’s first page and its review date. Note the last time you practiced it.	A template downloaded and never filled in, or no named owner or after-hours contact.
Vendors & suppliers	A list of outside services that hold your data or connect to your systems, and a sense of their security.	A short list naming each vendor and what they hold or can access.	Not knowing which vendors hold your data — their breach can become your claim.

Have most of this ready? Send it over with your application and we’ll take it from there. Missing a few? Those are exactly the gaps worth closing before you apply — your agency can help you sort them out.

Make it yours

What to have ready before you apply or renew