The Hartford cyber policy application, held
The questions of the CyberChoice Underwriting Application, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document, CyberChoice Underwriting Application (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. The Hartford is a source document, never a customer.
This document's questions reach 48 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 5 questions here are flagged knockout (a "no" is a common decline point) and 5 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
An answer about an existing state of affairs can be relied on by the carrier, but in Australia and the United Kingdom a statement by the insured is a representation, not a warranty (the Insurance Contracts Act and the Insurance Act), and the position varies by US state.
Application question And, is your business' email hosted through this web domain?
Answer options on this form: No / Yes.
No held control answers this line.
Application question Does the Applicant Company have any subsidiaries?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Nature of Operations As part of your business' operations, is there engagement in any service or activity involving or similar to the following?
No held control answers this line.
Application question Is more than 50% of the applicants' revenue derived from technology products and services (e.g., software, electronics, telecom?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Cybersecurity Function & Contact Person Is there a dedicated cybersecurity team monitoring the network for your business?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
ISO 27001:2022 A.5.1 Policies for information security
Evidence to have on file (guidance, our wording)
- The top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure
- The register of topic-specific policies with an owner, approving manager and version for each
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question If yes, is cybersecurity managed in-house or outsourced to a third party?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question If in-house, how many employees are dedicated to the cybersecurity team?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant Company currently purchase Cyber coverage?
This is a financials question, not a control requirement. It reaches no held control.
Answer options on this form: No / Yes.
No held control answers this line.
Application question Revenue Most Recent Completed Fiscal Year Revenue Current Fiscal Year (Projected) Revenue If part of your business' operations involves managing financial investments for others, please answer the following: • Most Recent Fiscal Year Assets Under Management • Current Fiscal Year (Projected) Assets Under Management Are there revenue-generating operations for your business outside the country of domicile?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If yes, what percentage of revenue is generated outside the country of domicile?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Is the Applicant Company a subsidiary of a parent company?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If yes, is the parent company domiciled outside the United States?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Has any applicant experienced within the past 12 months, or does any applicant anticipate experiencing in the next 12 months, a merger, acquisition, sale of any assets or similar transaction?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Data, Privacy & Media Data Inventory How many unique individual people or organization's nonpublic personal records are received, processed, stored or transmitted during the policy period as part of your business activities?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question at rest While electronically in transit While on mobile devices Backups & Recovery Is your business' critical data regularly backed up?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
Evidence to have on file (guidance, our wording)
- TLS configuration standards and scan results
- VPN and zero trust network access policy
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question weekly Yes, monthly If yes, are backups stored offline and/or isolated from production systems?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question And, how often do the applicants test recovering data from the backup?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Do all applicants have a Cyber Incident Response Plan or Business Continuity plan in place to respond to a computer system disruption?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question If yes, how often is the Cyber Incident Response or Business Continuity plan tested?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question Do the applicants all have a legal review process governing all content that's published both on and offline (including social media), including a formal process to ensure there isn't infringement of another's copyright, slogan, trademark, logo, trade name, service mark or brand?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Did your business acquire any trademarks in the last 3 years?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If yes, were such trademarks screened and cleared for infringement?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Security & Controls MFA Is Multi-Factor Authentication (MFA) required for ALL remote access to your business' network?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question If no, how is remote access to the network controlled?
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
ISO 27001:2022 A.8.22 Segregation of networks
Evidence to have on file (guidance, our wording)
- Network segmentation design defining domains by trust, criticality, sensitivity or organizational unit, with the assessment that justified it
- Firewall or filtering router rules controlling traffic between domains, with rule review records
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Is MFA required for access to email?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
Application question web-based email Funds Transfer Controls Do the applicants all have a dual authentication protocol for confirming all funds transfer requests or account information changes from a vendor/partner through a secondary method of communication before the account information is changed or a funds transfer request is carried out?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does any applicant accept fund transfer requests from customers?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question If yes, is the funds transfer instruction validated by a method other than the original means of request?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Is there an Endpoint Detection and Response (EDR) or Managed Detection and Response (MDR) product in place?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question for malicious attachments Screening for malicious links Tagging emails from external senders How often is Antiphishing and Cybersecurity Awareness training conducted for employees?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question During the past three years, has any applicant experienced any cyber incident (including claims, cyber attacks, cyber extortion demands, privacy breaches or system failures?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does any applicant or any natural person for whom insurance is intended have any knowledge or information of any error, misstatement, misleading statement, act, omission, neglect, breach of duty or other matter that may give rise to a claim, loss or obligation to provide breach notification under the proposed insurance?
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
No held control answers this line.
Application question If yes to either question above, has the Applicant Company reported this incident, knowledge or information to their current cyber carrier?
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
No held control answers this line.
Controls not asked in this held document (242)
None of this held document's questions reach 242 of the 290 held controls (for example A.5.2, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8, A.5.9, A.5.10). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.