Cyber insurance requirements: what insurers will ask for and how to prepare

By Kike Gandia · Co-Founder & CEO, OSCP

Buying cyber insurance is not just filling in a form and paying. The insurer decides whether to cover you, at what price and with which exclusions based on three things: your company profile, the information you give and the security controls you declare. And what you declare becomes part of the contract. This guide walks through the requirements in the order you will be asked for them, using a real application form published by an insurer and the Spanish Insurance Contract Act.

The requirements at a glance

Before the detail, the full map:

Block	What you are asked for	Why it matters
Eligibility	Sector, size, registered office and volume of sensitive data	Decides whether you get a standard tariff, manual underwriting or fall outside the insurer's appetite
Company information	Identification data, activity, consolidated turnover and incident history	Sets the price and the limit you can be offered
Technical controls	Patching, backups, multi-factor authentication and payment controls	A condition for the pre-quoted premium and for some covers
Questionnaire	A truthful, signed declaration of all of the above	The basis of the contract: a false answer can leave you without a payout
Documentation	Product information document, general and specific conditions	Where the real exclusions and limits are

Eligibility requirements: who can buy it

The first filter is not technical, it is about profile. Insurers define their risk appetite and apply it before looking at your controls. The pre-quoted application form Hiscox publishes on its Spanish website shows it clearly:

Outside its appetite are sectors such as banking, insurers and brokers, entities supervised by the CNMV or the Bank of Spain, gambling, defence, logistics, airports and airlines, payment gateways and national media.
Sent to manual underwriting, instead of the standard tariff, are manufacturers, companies with industrial automation systems (ICS, DCS or SCADA), hosting, cloud or managed IT providers, medical centres with more than 25 doctors and those processing sensitive data on more than 500,000 people, among others.
Size is measured by consolidated turnover, subsidiaries included, and having subsidiaries outside the European Economic Area or belonging to a group above €100 million also takes you out of the standard tariff.

Other insurers apply similar filters: Mapfre, for example, aims its cyber policy at sole traders and SMBs registered in Spain with adequate security levels in their systems. Sole traders can buy it too: the Hiscox form lists them as a type of policyholder.

The information you will be asked for

Have it ready before asking for a quote, because it is the same on almost every form:

Policyholder details: company name, tax ID, registered office, website and business activity.
Consolidated turnover of the policyholder and its subsidiaries, and the share billed online.
Personal data you process: whether it includes sensitive data —identity documents, bank or card details, health, biometrics, beliefs or other special categories— and on how many people.
Group structure: subsidiaries, the countries they are in and the group's consolidated turnover.
Incident history: any breach, outage, extortion, impersonation or fraudulent transfer in the last 24 months that caused more than €1,000 in losses, with its consequences and the corrective measures taken.
Cloud providers, if you want cover for an outage at a technology provider.

Technical requirements: the controls you must meet

This is the part most companies underestimate. In the published pre-quoted form, the standard premium is only valid if you answer yes to these controls:

Control	What exactly is required	How to prove it
Supported software	All programs and systems supported by the vendor; any unsupported one isolated from the Internet and the network, or under extended support	An inventory of systems with version and end of support
Patching	Updates applied within 30 days of release	A report from the patching tool with dates
Backups	At least weekly, on disconnected write-once media or with certain cloud providers with 30 days of retention and MFA on the console	A backup policy and a log of restore tests
Immutable backups	For companies from €2.5M to €25M, additionally, backups that cannot be altered or deleted from the source systems	Immutability settings or read-only storage
MFA on email	To cover fraud: multi-factor authentication on webmail for 100% of users	An MFA coverage report exported from the console
Payment control	To cover fraud: dual approval of payments above €10,000, except companies with 25 or fewer employees and a single signatory	A written payment procedure

If any answer is "no", you are not always left uninsured: the insurer asks for details and assesses the case individually, usually with a higher premium or exclusions. For larger policies or manual underwriting, questionnaires usually extend to endpoint protection (EDR), remote access, staff training and the incident response plan.

The questionnaire: a requirement with legal consequences

Under Article 10 of the Spanish Insurance Contract Act, before signing you must declare to the insurer, according to the questionnaire it gives you, every circumstance you know that may affect the assessment of the risk. You are released from that duty if no questionnaire is given or if the circumstance is not included in it.

What you answer has concrete effects:

If the insurer discovers a reservation or inaccuracy, it can terminate the contract within a month of learning about it.
If a claim arrives first, the payout is reduced in proportion to the difference between the premium you paid and the one you would have paid declaring the real risk.
In case of fraud or gross negligence, the insurer is released from paying.

And the duty does not end when you sign. Article 11 requires you to report during the policy term, as soon as possible, any circumstances that increase the risk. The Hiscox form itself says any later change to what was declared must be reported. If you stop meeting a control, tell the insurer before a claim, not after.

The documents you should receive before signing

Buying insurance also gives you information rights. Before signing you should have:

The insurance product information document (IPID): a standardised EU-wide summary, regulated by Commission Implementing Regulation (EU) 2017/1469, covering what is insured, what is not and the main restrictions.
The general conditions, with the covers, the exclusions and the claims procedure.
The specific conditions, with your limit, sublimits, deductible and waiting period.

Under Article 3 of the Spanish Insurance Contract Act, clauses that limit your rights must be specially highlighted and specifically accepted in writing. If an important exclusion does not appear that way, ask before signing.

Checklist for buying without surprises

The order we recommend to reach the purchase with everything settled:

Check whether your sector and size fit the standard tariff or go to manual underwriting.
Gather the company information: consolidated turnover, personal data you process and incident history.
Verify each technical control with evidence, not from memory: patching, backups, MFA and payment control.
Close the gaps before asking for a quote, not after signing.
Answer the questionnaire with verified data and keep a copy.
Read the IPID and the specific conditions before signing, starting with exclusions and sublimits.
Decide how you will report any change in the controls to the insurer during the policy term.

We do not sell insurance. Our role is the technical side: verifying the controls before you declare them and putting you in touch with specialist brokers and insurers we work with.

FAQ

What are the requirements to buy cyber insurance?

Three kinds. Eligibility: your sector and size must fit the insurer's appetite. Information: company details, turnover, personal data you process and recent incidents. And technical: in a real published form, supported software patched within 30 days, at least weekly isolated backups and, to cover fraud, MFA on email and dual approval of payments.

Do I need a pentest or an audit to buy it?

For the standard SMB tariff, usually not: the questionnaire is enough. For manual underwriting, higher-risk sectors or high limits, the insurer may ask for additional evidence. Either way, a vulnerability assessment or a penetration test is the most direct way to check that what you are about to declare is true.

Can I buy it without MFA on email?

Possibly, but with limitations. In the form published by Hiscox, MFA on webmail for 100% of users is a requirement for the extension covering impersonation and fraud. Without it, that cover falls outside the standard tariff.

Can a sole trader buy it?

Yes. There are products aimed at sole traders and SMBs, and the Hiscox pre-quoted form includes the sole trader as a type of policyholder. The technical requirements are the same, adapted to a smaller structure.

What if I suffered a cyberattack in the last two years?

It does not stop you buying, but it changes the quote. An incident with more than €1,000 in losses in the last 24 months takes the company out of the standard tariff in the published form: you will have to describe it, explain its consequences and the corrective measures, and the insurer will assess the case.

Do I have to report changes after buying?

Yes. Article 11 of the Spanish Insurance Contract Act requires reporting during the policy term any circumstances that increase the risk. If you stop meeting a control you declared, such as MFA or isolated backups, report it to the insurer before any claim occurs.

Sources

Verify my controls before buying cyber insurance