Coalition cyber policy application, held
The questions of the Questions in a Coalition Cyber Policy Application, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. Coalition is a source document, never a customer.
This document's questions reach 23 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 1 question here is flagged knockout (a "no" is a common decline point) and 0 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
This form heads the block "Attestation Questions" and confirms the answers by the Named Insured's e-signature, so each answer here is a statement the carrier relies on.
This is a loss history question, not a control requirement. It reaches no held control.
Answer options on this form: No / Yes.
No held control answers this line.
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
Answer options on this form: No / Yes.
No held control answers this line.
Answer options on this form: No / Sometimes / Yes.
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
- The topic-specific removable media policy and evidence it was communicated to users
- Endpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
- TLS configuration standards and scan results
- VPN and zero trust network access policy
Answer options on this form: No / Yes.
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Answer options on this form: No / Yes.
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
- Backup policy with frequency and retention
- Backup integrity test reports
Answer options on this form: No / Yes.
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
- Access policy framework with role definitions
- Privileged access management deployment evidence
This is a loss history question, not a control requirement. It reaches no held control.
Answer options on this form: No / Yes.
No held control answers this line.
This is a media liability question, not a control requirement. It reaches no held control.
Answer options on this form: No / Yes.
No held control answers this line.
Controls not asked in this held document (267)
None of this held document's questions reach 267 of the 290 held controls (for example A.5.1, A.5.2, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8, A.5.9). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.