Cyber policy renewal readiness: pricing

What will you put in the box about multi-factor sign-in?

Probably 'partly'. The renewal application lands a month ahead, holds close to a hundred questions, and half of them want paper rather than an opinion: logs, a restore report, a written plan. Every 'no' here means a different premium and a different deductible.

The application is ready by renewal day

'Partly' turns into 'yes', and behind every 'yes' there is work done. We go through your insurer's form from top to bottom: we set up multi-factor sign-in, endpoint protection and disk encryption, write the plan for a breach, start the staff training.

We also do the one thing insurers ask about most and almost nobody can show: we restore your data from backup for real, time it and write the report. The usual answer to that question is 'we take backups' — and nothing more.

By renewal day you hold the completed application, the attachments and the letter to your broker. The paperwork will not go stale before the next renewal: we keep it current.

What the preparation covers

included: Your insurer's form gone through question by question
included: Multi-factor sign-in everywhere the insurer asks for it
included: Endpoint protection and disk encryption
included: A real restore from backup, timed and written up
included: A written plan for the day you are breached
included: Staff training and a report on who completed it
included: The completed application with attachments and a letter to the broker
paid to the vendor: The premium and the broker's work come on the insurer's invoice

Your price

Renewal preparation

$2,250 one-off

The application is answered and evidenced by renewal day.

What the tier includes

included: Going through the application, closing the 'no' answers and building the attachment pack

Looking after it between renewals

$345 a month

The paperwork for the next renewal is ready in advance.

What the tier includes

included: We keep the paperwork current and answer the insurer's questions all year

Extras

not included: An external penetration test as the policy demandsfrom $4,480
not included: We watch for attacks around the clock$18 per endpoint a month
not included: If you are breached, we investigate — monthly$670 a month
not included: Backups and a check that they actually restore$1,340 per site per year
not included: Fractional chief information security officerfrom $2,500 a month
not included: Questionnaires your client has sent$1,350 per questionnaire
not included: SOC 2 readinessfrom $2,250
not included: Patient records kept protected+$40 per seat

Questions

We already have a policy. Why prepare ahead?

Because the questions come round at every renewal, and half the answers cannot be changed in a week: the training had to happen, the restore had to be tested, the sign-in history had to build up. You start a quarter before the date, not a week.

We answered 'yes' last year. Is that enough?

No. You are the one who signs the application, and the answers will have to be proved when it comes to a claim. So every 'yes' of ours rests on a document: a configuration, a report, a training record. The whole pack stays with you — it also works for clients and auditors.

Our insurer sent its own form, not a standard one.

That is how it goes — there are dozens of forms out there. We work to yours: it sets the scope and the order. The price does not change for it, because everyone asks about the same things, in different words and a different order.

What if the broker insists on a penetration test?

We run it as a separate job and put the report into the same application. Insurers accept a report where every finding comes with the steps to reproduce it. The price of the test is in the line above and is not part of the preparation.

Preparing for a cyber policy renewal