There is one document that will tell you more about the state of your company's security than any assessment you could pay for, and you are going to fill it in anyway. It is the cyber-insurance application.
I have written the readiness list for a business preparing to apply, and I have answered an insurer's own questions about an environment that had just been rebuilt. Both times the questions were the ones I expected, because carriers ask overlapping versions of the same short list, for the same reason: these are the things that decide whether a bad day becomes a bad year. Nobody pays a consultant to tell them that list. The insurer hands it over for free, and the owners I talk to treat it as paperwork to get past rather than the roadmap it is.
Here is the list as I have seen it, and what each question is really asking.
The ten things
Multi-factor authentication, and where exactly. The question is where: on email, on remote access, on anything an administrator uses, on the accounts that can move money. The honest answer is usually "on some of it." Write down which.
How people get in from outside, and who holds the keys. This is the remote-access question, and underneath it is a sharper one: how many people can administer the environment, and can you name them today without looking anything up. If the number is "a few, I think," that is an answer, and it is the wrong one.
Backups, and whether you have ever restored one. Everyone has backups. The question is whether a copy exists that an attacker inside your network could not reach or alter, and whether anyone has actually restored a real system from it and timed how long that took. A backup you have never restored is a hope.
Something watching the endpoints. Every laptop and server should have software on it that notices behavior, not just known bad files, and someone should be told when it notices something. If nobody is told, you have installed a diary.
A patch cadence you can state in one sentence. Not a policy, a cadence. "Operating systems and browsers within two weeks of release, everything else monthly, and here is the list of the old systems we cannot patch and what we did about them instead." The old systems are the part the underwriter is actually asking about.
Whether the world can verify that your email is really yours. There are three published mechanisms that let receiving mail systems check that a message claiming to come from your domain was allowed to, and a business that has not set all three up is easier to impersonate. This question is showing up on more forms each year, and it is the one owners are most surprised to fail.
Logs, how long you keep them, and who reads them. Not every form asks this yet, and the ones that do tend to be the ones rewritten after a bad claims year. The retention question is fair. The follow-up is the one that matters: is anyone named to look at them, and how often.
A written incident plan you have opened this year. Who decides to disconnect a system, who calls the carrier, who preserves evidence before anyone starts fixing things, and who talks to customers. If the plan lives in one person's head, the form is asking you to notice that.
What happens when someone joins or leaves. This one is newer on the forms than the others, and it is coming. Every account a departed employee still holds is an account with nobody watching it. The question wants a process with an owner.
Prior incidents and claims. Answer this one exactly. The temptation to round down is real, and this is the place on the form where an incomplete answer is the kind of thing an insurer can hold against you later.
Why the form is a roadmap
Read the ten again as a list of controls rather than questions, and you will notice something. They are not random. Each one is on the form because its absence showed up in claims the carrier paid, which is a more expensive research method than any of us can afford.
So here is what I would do with it. Before your next renewal, answer all ten in writing, honestly, with a plain yes, no, or partly beside each. The "no" and "partly" answers, sorted by what each would cost to fix, are your security plan for the next twelve months. You did not have to hire anyone to write it. You had to be honest with a form.
Check what you already own before you buy anything
One more thing I have watched happen, and it belongs here because the roadmap above will tempt you toward purchases.
A design needs a capability, say the ability to grant access by group rather than person by person, or to require a second factor only under certain conditions. The tier that provides it costs more than the tier the business is on, so an upgrade goes on the list. Before anybody buys, somebody checks the subscription the business already holds, and the capability turns out to be inside it. The work was to switch it on.
I am not going to tell you that is always the case, because it is not. I am telling you to check, every time, before you approve a security purchase: ask the vendor to show you, from your own account, what your current subscription already includes for this capability. A vendor who does that willingly is a vendor you can trust with the next question.
Two words to watch for
While you are reading quotes and questionnaires, watch for the word "compliant" and the word "certified." A system can be built in line with a standard. That is a design property, and a good one. Being certified against the standard is a separate thing, granted by an accredited outside body, and some standards offer no certification at all, in which case the honest word is that a vendor attests. Being compliant is a third thing again, a statement about how the business operates every day rather than about how one system was built.
A vendor who says "aligned to" when the truth is "aligned to" is telling you the truth. A vendor who says "compliant" about a piece of equipment is either careless with words or hoping you are. Either way, it tells you something.
Be the second kind of owner
The form is coming, and the forms I have seen keep getting longer. The owners who dread it are the ones who open it cold in the week it is due. The owners who find it useful are the ones who worked through it while nothing was at stake, fixed two things, and now fill it in from a page they already wrote.
Be the second kind. Circle every no on your own copy first. Check what you already own before you spend a dollar on any of it. Then, when the real form arrives, you will be reading questions you have already answered, which is the only comfortable way to read that document.
I write for owners who would rather answer the hard questions early, from inside real operations. More at pathinsights.io.