Hiscox UK cyber policy application, held
The questions of the CyberClear Proposal form for companies sub-10 million turnover, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. Hiscox UK is a source document, never a customer.
This document's questions reach 36 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 5 questions here are flagged knockout (a "no" is a common decline point) and 0 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
Application question 2 Accredited information Has your organisation been accredited with any information security standards?
This is an attestation question, not a control requirement. It reaches no held control.
Answer options on this form: No / Yes.
No held control answers this line.
Application question Past year ending Current year Estimate for / / coming year Total income £ £ £ Income generated £ £ £ in the USA Web sales (total) £ £ £ 1.5 Personal data For how many people (including customers and suppliers, but excluding employees) do you process, transact or store basic profile information (name, address, email, phone number?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question 500,000 – 999,999 Less than 100,000 1,000,000 – 5,000,000 100,000 – 499,999 Over 5,000,000 PF-PIP-UK-CCLEAR(3) 19833 12/20 CyberClear Proposal form for companies sub-£10 million turnover 1.6 Sensitive information For how many people (including customers and suppliers, but excluding employees) do you process, transact or store any of the following information: a. credit or debit card information; b. bank details; c. medical information; or d. government issued identification?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do you have a formal password policy that explains good password hygiene, such as not using obvious or repeated passwords, for all systems providing access to personal or confidential information?
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
Evidence to have on file (guidance, our wording)
- Identity management platform configuration baseline
- Joiner mover leaver workflow with timing SLAs
Application question Do you update all systems including firewalls and anti-virus software at least every 30 days?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- EDR coverage report by asset class
- File integrity monitoring baseline and drift alerts
Application question Are full system backups taken at least weekly and stored either off site or disconnected from your network?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
ISO 27001:2022 A.7.1 Physical security perimeters
Evidence to have on file (guidance, our wording)
- Site plans showing defined security perimeters and their strength relative to the assets inside
- Physical security surveys or assessments of walls, roofs, floors, doors, windows and vents
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
NIST CSF 2.0 PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk
Evidence to have on file (guidance, our wording)
- Physical access control system inventory
- Badge issuance and revocation records
Application question Do you have a policy to encrypt mobile computing devices (for example laptops, tablets, mobile telephones, PDAs) and portable data storage media (for example external drives or magnetic tapes) which hold, process, transact or store any of the personal data referred to in 1.7?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.7.10 Storage media
Evidence to have on file (guidance, our wording)
- The topic-specific removable media policy and evidence it was communicated to users
- Endpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
NIST CSF 2.0 PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
Evidence to have on file (guidance, our wording)
- TLS configuration standards and scan results
- VPN and zero trust network access policy
Application question Do all users with remote access provide at least two different forms of identification ('multi-factor authentication') to verify their identity prior to log-in?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Do you require multi-factor authentication for all online banking logins?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
Application question Do you ensure multi-factor authentication for any fund transfer?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Do you have a process in place to confirm that any payment requests received by email are from a known source?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Have you suffered any loss or has any claim whether successful or not circumstances ever been made against you?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Are you aware of anything that may lead to a claim, loss or other liability that might be covered under the policy?
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
No held control answers this line.
Application question Have you ever been investigated in respect of personal data, including but not limited to payment card information, or your privacy practices?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Have you been asked to supply any regulator or similar body with information relating to personally identifiable information or your privacy practices?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Have you ever been asked to sign a consent order or equivalent in respect of personally identifiable information or your privacy practices?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Have you ever received a complaint relating to the handling of someone's personally identifiable information?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Is there anything else that you would like to tell us about you or your business?
No held control answers this line.
Controls not asked in this held document (254)
None of this held document's questions reach 254 of the 290 held controls (for example A.5.1, A.5.2, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8, A.5.9). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.