RLI cyber policy application, held
The questions of the RT Connector Cyber Application, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. RLI is a source document, never a customer.
This document's questions reach 26 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 0 questions here are flagged knockout (a "no" is a common decline point) and 0 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
Application question Does the applicant have existing coverage?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question What is the estimated unique record count of personal identifiable, protected health and payment card information stored or processed?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Is the applicant engaged in any of the following business activities?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Select all that apply) Adult Content Managed IT Service Provider (MSP of MSSP) Cannabis Remote Network Administration Services Provider Payment Processing (e.g. as a Payment Processor, Merchant Cryptocurrency or Blockchain Acquirer, or Point of Sale System Vender) Debt Collection Agency None of the Above Gambling Version 1.12 1| Connector Cyber Liability Application August 2025 Connector Cyber Liability Application Small business accounts up to $100 million revenue Does the applicant perform backups of critical data at least weekly and ensure those backups are protected or stored separately from their production environment?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Internal use of privileged accounts In the past three years, has the applicant and any other persons or organizations proposed for this insurance, including all subsidiaries, experienced a cyber event, loss, or claim that would fall within the scope of the policy for which they are applying?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Is the applicant and any other persons or organizations proposed for this insurance, including all subsidiaries, aware of any fact, circumstance, situation, event, regulatory action, or wrongful act which reasonably could give rise to a cyber event, loss, or a claim being made against them that would fall within the scope of the policy for which the applicant is applying?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the applicant use a Managed Service Provider (MSP?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the applicant have formal policies and procedures in place for secure fund transfers, such as senior management approval and obtaining verbal confirmation for any fund transfer requests?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
NIST CSF 2.0 GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Evidence to have on file (guidance, our wording)
- Cybersecurity risk management policy approved by leadership
- Policy linkage matrix to standards and procedures
Application question Prior to executing an electronic payment, does the applicant verify the validity of the funds transfer request or payment change request, with the requestor, via a separate means of communication prior to transferring funds or making payment changes?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Does the applicant encrypt all physical devices, critical data, sensitive emails?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.7.10 Storage media
Evidence to have on file (guidance, our wording)
- The topic-specific removable media policy and evidence it was communicated to users
- Endpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
NIST CSF 2.0 PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
Evidence to have on file (guidance, our wording)
- TLS configuration standards and scan results
- VPN and zero trust network access policy
Application question Select all that apply) Devices Data Emails No Encryption Media and Content Controls If the applicant uses multimedia material provided by others, do they always obtain the necessary rights, licenses, releases, and consents prior to publishing?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Within the last 3 years has the applicant been subject to any complaints concerning the content of its website, advertising materials, social media, or other publications?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the applicant enforce procedures to remove content that may infringe or violate any intellectual property or privacy right?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If the applicant accepts payment cards, is the applicant PCI compliant or using an outsourced payment processor that is PCI compliant?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the applicant collect, store, host, process, control, use or share any biometric information or data?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If yes, have they reviewed all relevant state and federal laws with a qualified attorney, to ensure compliance?
No held control answers this line.
Application question Does the company scan email for potentially malicious attachments and / or links?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
Application question In the last 3 years, has the applicant or any other organization proposed for this insurance sustained any unscheduled network outage or interruption lasting longer than 6 hours?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Controls not asked in this held document (264)
None of this held document's questions reach 264 of the 290 held controls (for example A.5.1, A.5.2, A.5.4, A.5.5, A.5.6, A.5.7, A.5.8, A.5.9). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.