At-Bay cyber policy application, held
The questions of the Cyber Insurance Short Application, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. At-Bay is a source document, never a customer.
This document's questions reach 18 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 1 question here is flagged knockout (a "no" is a common decline point) and 1 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
An answer about an existing state of affairs can be relied on by the carrier, but in Australia and the United Kingdom a statement by the insured is a representation, not a warranty (the Insurance Contracts Act and the Insurance Act), and the position varies by US state.
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
- Backup policy with frequency and retention
- Backup integrity test reports
- Third party risk management program charter
- Supplier risk policy with tiering criteria
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
- Access policy framework with role definitions
- Privileged access management deployment evidence
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
No held control answers this line.
This is a financials question, not a control requirement. It reaches no held control.
No held control answers this line.
Controls not asked in this held document (272)
None of this held document's questions reach 272 of the 290 held controls (for example A.5.1, A.5.2, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8, A.5.9). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.