How to answer client security questionnaires and cyber insurance applications

The way to answer client security questionnaires and cyber insurance applications is to answer precisely, back each answer with evidence you can produce on request, and keep that evidence current so the next form takes hours instead of weeks. Both documents ask variations of the same questions: multi-factor authentication, endpoint protection, backups, incident response, and how you manage vendors. Vague or optimistic answers create real risk. They can cost a deal when a client follows up, and they can complicate a claim if the insurer later finds the controls were not in place as described.

The questions that come up every time

Enterprise client questionnaires vary in length, but the core topics are consistent. Cyber insurance applications cover much of the same ground. Expect to answer:

• Multi-factor authentication. Is it enforced for email, remote access, and administrator accounts? Which methods? CISA’s phishing-resistant MFA fact sheet calls phishing-resistant MFA “the gold standard” and notes that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” Know which of your users are on which method.
• Endpoint detection and response. Is EDR deployed on every endpoint and server, and who monitors the alerts, around the clock or business hours only?
• Backups. Are backups offline or otherwise isolated, encrypted, and tested? The CISA #StopRansomware Guide recommends that organizations “maintain offline, encrypted backups of critical data” and “regularly test the availability and integrity of backups in a disaster recovery scenario.” Expect the follow-up question: when did you last test a restore?
• Incident response. Do you have a written plan, who is on it, and when was it last exercised?
• Vendor management. How do you assess the security of the vendors who handle your data, and do your contracts require them to notify you of incidents?
• Patching, access reviews, and training. How quickly are critical patches applied, how often is access reviewed, and how often is staff trained?

Why vague answers are expensive

“Yes, we use MFA” is a common answer in questionnaires, and often an incomplete one. MFA may be enforced for email but not for the remote access tool, or for most users but not the service account that still uses a password. When a client’s security team asks for a screenshot of the policy, or an insurer asks during underwriting, the gap surfaces.

The consequences differ by audience. With a client, an answer you cannot support damages trust during procurement, and a deal can stall in security review. With an insurer, an inaccurate application can create problems when you need the policy most. The stakes are real: IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million, a record high. Confirm questions about policy terms and the effect of application answers with your broker and counsel.

The fix is to answer what is true, qualify where controls are partial, and state what is in progress with a target date. A partial answer stated precisely reads better to a reviewer than a confident one that does not hold up.

Build an evidence library once

Most organizations answer each questionnaire from scratch, chasing the same screenshots and policy documents every time. An evidence library breaks that cycle. For each common control, keep:

• A short, accurate description of how the control works in your environment.
• The supporting artifact: a policy document, a configuration export, a report, or a screenshot with a date.
• The owner responsible for keeping it current.
• The date it was last verified.

Then keep a master answer set for the questions you see most often, mapped to that evidence. New questionnaires become a matter of matching questions to existing answers and reviewing anything new.

Map your answers to NIST CSF 2.0

Questionnaires use different wording, but most map cleanly to the NIST Cybersecurity Framework 2.0, which organizes security into six Functions: Govern, Identify, Protect, Detect, Respond, and Recover. Organizing your evidence library by these Functions does two things. It gives you a stable structure that does not change with each client’s template, and it shows where you are thin. If your Respond and Recover evidence is a single outdated document, you will see that before a reviewer does.

The Govern function is worth particular attention. NIST describes it as the organization’s cybersecurity risk management strategy, expectations, and policy being “established, communicated, and monitored.” Questionnaires increasingly ask who owns security, how leadership is informed, and how often policies are reviewed. Those are Govern questions, and they need named owners and dates, not just a policy file.

Keep answers current with a live posture view

Evidence goes stale. A screenshot from last spring does not show whether a new hire was left out of the MFA policy last month. The more your evidence is generated from live systems rather than collected by hand, the less effort each questionnaire takes and the more accurate the answers are.

Our AiT Trust Portal publishes security posture (policy compliance, endpoint health, incident metrics, and audit evidence) in a branded, real-time dashboard that can be shared with leadership. It produces evidence packages on demand and replaces the quarterly spreadsheet that is out of date the day it is finished.

State your status precisely

The same discipline applies to describing certifications and audits. Intelligent Group’s own SOC 2 Type II audit is in progress. That is how we describe it on our trust center, in questionnaires, and in sales conversations: in progress, not certified, not “compliant.” Reviewers notice the difference, and precise language about status earns more credibility than optimistic language that a follow-up question will undo.

Treat questionnaire and application work as an operating process with an owner. Track how many requests arrive, how long each one takes to answer, and which questions repeatedly need new evidence. Those numbers show where the evidence library has gaps and whether the effort is falling quarter over quarter.

How Intelligent Group can help

Intelligent Group helps organizations build an evidence library, map it to NIST CSF 2.0, and close the gaps that questionnaires keep exposing. Our compliance support team can work through a specific questionnaire or insurance application with you, and our security and compliance improvement work addresses the underlying controls so the next answer is a clean yes. For organizations that answer questionnaires often, the AiT Trust Portal keeps the evidence current. Contact us to start with a review of your most recent questionnaire.

Frequently asked questions

What if we cannot answer “yes” to a questionnaire item?

Answer accurately and explain the current state, any compensating controls, and the planned date for closing the gap. Reviewers generally prefer a precise partial answer with a plan over an unqualified yes that does not hold up under follow-up. Keep the commitment realistic, because it may be asked about later.

Are cyber insurance applications the same as client questionnaires?

They overlap heavily, covering MFA, EDR, backups, incident response, and vendor management. The difference is the consequence of an inaccurate answer, which can affect coverage. Review application answers carefully and confirm questions about policy terms with your broker and counsel.

How often should our evidence library be updated?

Review it at least quarterly, and update individual items whenever the underlying control changes. Evidence generated from live systems, such as a posture dashboard, stays current with less effort than screenshots collected by hand.

Why map answers to NIST CSF 2.0?

It gives you a stable structure that works across different clients’ questionnaire formats. The six Functions (Govern, Identify, Protect, Detect, Respond, Recover) also make gaps visible, so you can fix them before a reviewer finds them.