Underwriting
In one sentence
How an insurer evaluates your risk to decide whether to cover you, on what terms, and at what price.
Underwriting is the insurer's risk assessment. For cyber, it has become a security audit: the carrier reviews your controls (via the application and sometimes an external scan) and prices or declines the policy accordingly.
Why it's on your cyber insurance application
Your application answers ARE the underwriting inputs, which is why accuracy and documentation matter.
What this looks like in practice
Underwriters are not trying to catch you out. They're trying to price a risk with very little information, which is why specific answers beat confident ones. "MFA enforced on all mailboxes since March, screenshot available" tells them more than "yes", and it's the kind of answer that gets questions resolved without a second round.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
- Application-Mapping Guide: Which Document Answers Which Question (preview its opening sections)
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.