Beazley cyber policy application, held
The questions of the Cyber Insurance Application (revenues lower than $250M), held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. Beazley is a source document, never a customer.
This document's questions reach 44 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 3 questions here are flagged knockout (a "no" is a common decline point) and 0 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
Application question Do you have any revenue-generating operations outside your domiciled country?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Are you engaged in any of the following business activities?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do you require Multi-Factor Authentication (MFA) for remote access to your network (both cloud-hosted and on- premises, including via Virtual Private Networks (VPNs)?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Do you require MFA for access to web-based email?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
Application question What security controls do you have in place for incoming email?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
Application question How often do you conduct interactive social engineering (i.e., phishing) training?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question Do you protect all company devices with anti-virus, anti-malware, and/or endpoint protection software?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- EDR coverage report by asset class
- File integrity monitoring baseline and drift alerts
Application question Do you regularly back up your business critical data?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Do you, or an outsourced service provider on your behalf, actively manage and install critical patches across your internet-facing systems?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question Do you use the Microsoft 365 Defender add-on or an equivalent cybersecurity product with advanced threat hunting to protect against phishing and business email compromise?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources
Evidence to have on file (guidance, our wording)
- Threat intelligence subscriptions and ISAC memberships
- Intelligence ingestion workflow with curation
Application question Do you disable macros in your office productivity software by default?
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
ISO 27001:2022 A.8.9 Configuration management
Evidence to have on file (guidance, our wording)
- Approved secure configuration templates or baselines for each platform, derived from vendor or independent guidance, with review dates
- Configuration records or a CMDB showing owner, last change date, template version and relationships between assets
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC8.1 Managing changes to procedures, software, data and infrastructure
Evidence to have on file (guidance, our wording)
- Change management policy covering normal, standard and emergency changes
- Sample of change tickets with approval, testing evidence and deployer different from author
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- EDR coverage report by asset class
- File integrity monitoring baseline and drift alerts
Application question What security solutions do you use to prevent or detect malicious activity on your network?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Do you use a hardened baseline configuration across all (or substantially all) of your devices?
ISO 27001:2022 A.8.9 Configuration management
Evidence to have on file (guidance, our wording)
- Approved secure configuration templates or baselines for each platform, derived from vendor or independent guidance, with review dates
- Configuration records or a CMDB showing owner, last change date, template version and relationships between assets
SOC 2 CC8.1 Managing changes to procedures, software, data and infrastructure
Evidence to have on file (guidance, our wording)
- Change management policy covering normal, standard and emergency changes
- Sample of change tickets with approval, testing evidence and deployer different from author
NIST CSF 2.0 PR.PS-01 Configuration management practices are established and applied
Evidence to have on file (guidance, our wording)
- Configuration management standards by platform
- Hardening baselines and compliance reports
Application question If you rely on a cloud-based backup service, is it a "syncing service"?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Do you have an incident response plan for network intrusions and malware incidents?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do you have a formal review process in place to screen any published or broadcast material (including digital content), for intellectual property and privacy compliance prior to any publication, broadcast, distribution, or use?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If "Yes" to a., are such reviews conducted by, or under the supervision of, an attorney?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do you have notice and take-down procedures in place to address potentially libelous, infringing, or illegal content on your website(s) (e.g., DMCA or similar?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Are employees who are responsible for disbursing or transmitting funds provided anti-fraud training, including detection of social engineering, phishing, business email compromise and other scams, on at least an annual basis?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question When a vendor or supplier requests any change to its account details (including routing numbers and account numbers), do you confirm requested changes via an out-of-band authentication (a method other than the original means of request?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Have you, within the past 12 months, completed or agreed to a merger, acquisition, or consolidation?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Controls not asked in this held document (246)
None of this held document's questions reach 246 of the 290 held controls (for example A.5.1, A.5.2, A.5.3, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.