surable

How we know

Where everything on this site comes from

The short answer

39 sources: control frameworks, carrier and underwriting material, claims and threat reports, regulators, and free government help. They become 12 requirement objects, which become the 14 scored questions in the Readiness Check and the 20 documents in the pack. Every entry carries the month a person last checked it, most recently July 2026, and 35 of the 39 link straight to the source.

The 4exceptions: the carrier applications, which aren't published anywhere, and three rules we cite by name while we settle on the canonical page for each. They stay in the registry either way, so a claim that rests on one can still be traced.

How a source becomes a score, and then a document

Nothing here is scraped. Each source is read, and what it requires is written down as a requirement object: the control, the source clause behind it, the application questions it answers, the fix if you don't have it, and the document that evidences it. Those objects are the single upstream for everything you see.

The Readiness Check is the runtime projection of them, which is why every question it asks carries the framework clause it came from. The gap guidance you get after the Check is the remediation field of the same object. The documents in the pack are what close it, section by section. And the glossary defines the words those three use, so nothing depends on you already knowing the jargon.

A mismatch between any two of those layers is a bug, not a judgment call, and tests fail the build when one appears.

Three rules we don't bend

No statistic without a source.If a number can't be traced to an entry below or to our own published Check aggregates (with the sample size), it doesn't get written. That rules out the plausible-sounding figures that circulate in security marketing.

Dates on everything. A 2021 ransomware statistic describes a market that no longer exists, and a carrier form from two years ago asks questions that have since changed. Each source shows when it was last verified, and the ones that move fastest get checked most often.

Nothing is published by a machine.A watch process diffs these sources weekly and proposes changes as a reviewable edit, naming what moved and which layer it affects. A person reads it and decides. That means a stale entry is possible; a silently rewritten one isn't.

Control frameworks

The baselines carriers borrow their questions from. When we say a control is standard, this is what makes it standard rather than our opinion.

The carrier forms themselves

Applications and supplemental questionnaires from the carriers writing small-business cyber (Coalition, Chubb, Travelers, At-Bay, Corvus, Hiscox, Beazley). This is where the question wording comes from. There's no link because they arrive as PDFs through an agent: we keep the extracted questions, not the documents.

  • Carrier applications & supplemental questionnaires

    verified July 2026

Claims and threat data

Where the statistics come from. Each is cited with the report and the year, because a 2021 ransomware number describes a market that no longer exists.

Regulators and law

The rules already sitting on a business before any insurer asks: the FTC Safeguards Rule, the HIPAA Security Rule, state breach-notification law, PCI DSS. General information, never legal advice.

Free help we point you to

Government and nonprofit services that cost nothing. Our gap guidance sends you here first, because most of the common gaps close without a purchase.

Buyer education

Plain-language explainers of what cyber policies actually cover, from the industry's own information institute and from the body state insurance regulators run.

Found something out of date?

Tell us and we'll check it. A superseded framework revision, a carrier form with new wording, a report whose latest edition moved a number: all of it matters more to us than to you, because the scoring downstream is only as current as this list. Send it over.

Common questions

Where do Surable's statistics come from?+

Each one comes from a named report in the registry on this page, cited with its year, or from our own aggregated Readiness Check results published with the sample size. Nothing comes from memory, and a claim with no source doesn't ship.

How often are the sources checked?+

Each entry carries the month a human last verified it. A watch process re-reads the registry weekly, flags anything that moved, and proposes the edit; a person reviews and merges it. Frameworks move rarely, carrier forms and claims reports move every year.

Is any of this legal or insurance advice?+

No. The regulatory sources are listed so you can read the rules yourself, and whether one applies to your business turns on facts we don't know about it. Coverage decisions belong to carriers, and compliance questions belong to your own advisor.

General readiness information, not legal or insurance advice. Whether a regulation applies to your business turns on facts we don't know about it, and coverage decisions are the carrier's.

See it applied to your business

The free Readiness Check turns all of this into a score across the ten control areas carriers probe, with the framework clause behind every question and the fix for every gap. Five minutes, no email needed for the score.

Take the Readiness Check