Sample document
This is the document that turns a policy into an answer.
Owning a policy and answering the question are different jobs. For each question pattern carriers use, the guide gives the standard an honest “yes” has to meet and the document and section that proves it. Here are the first two of fifteen. The green highlights are the blanks a short intake fills in with your business.
Application-Mapping Guide
Which document answers which cyber insurance application question
Company: company name · Version: 1.0 · Sources verified: July 2026
This is the document that makes the pack different from a folder of templates. Cyber applications across the major small-business carriers (Coalition, Chubb, Travelers, At-Bay, Corvus, Hiscox, Beazley, and others) ask remarkably consistent questions. Below: each question pattern, the honest-answer standard, and exactly which document and section is your evidence.
Wording varies by carrier and form year. Where a carrier's phrasing differs in a way that matters, a note calls it out. Verify against your carrier's actual form, and keep this guide with your completed application.
Q1. "Is MFA required for all email accounts?"
- Answer standard: "yes" only if MFA is enforced for every mailbox, not opt-in.
- Evidence: Password & MFA Policy §3.1; an enforcement screenshot from your email admin console; the exceptions log (Appendix A) if any exceptions exist.
- If not yet: turn on enforcement first (free, an afternoon). This single "no" drives declinations.
Q2. "Is MFA required for administrative/privileged access?"
- Evidence: Password & MFA Policy §3.1 and Access Control Policy §4 (the named-admins list). Carriers sometimes ask for the count of privileged accounts; Appendix A of the Access Control Policy is your source.
The preview stops here. The rest of the guide covers:
- Q3. "Is MFA required for remote network access? Is RDP exposed?"
- Q4. "Describe your backups: frequency, off-site/offline copies, testing."
- Q5. "How quickly are critical patches applied? Any end-of-life systems?"
- Q6. "What email security protections are in place?"
- Q7. "Do you have a written incident response plan? Has it been tested?"
- Q8. "Do you provide security awareness training? Is it documented? Do staff acknowledge written policies?"
- Q9. "How is access managed when employees leave?"
- Q10. "Do you verify funds-transfer and payment-detail changes?" (often in a crime or funds-transfer-fraud supplement)
- Q11. "What sensitive data do you hold, and roughly how many records?"
- Q12. "Are mobile/personal devices controlled (encryption, wipe)?"
…and 4 more sections.
All of it ships in the pack, editable and filled in with your business.
Also readable before you buy
The rest of this document, and the other 19, are in the pack.
Twelve policies, the incident response plan, the training kit, and the application-mapping guide that ties each document to the question it answers. All of them written like what you just read, and personalized by the same short intake.
14-day no-questions refund · editable files · yours forever
Want to see the personalization itself? Preview the intake. It's the same few questions buyers answer before download.