Cyber insurance questionnaires: answering the continuity questions

The three questions carriers ask

Questionnaires vary by carrier and change from year to year. When a continuity section appears, it tends to come down to three questions, whatever the wording.

• Do you have a documented business continuity or disaster recovery plan?
• Is it tested or reviewed on a schedule?
• Can critical functions continue if key staff or systems are unavailable?
• Many small firms tick yes to all three from memory. The tick is not the problem. The problem comes after a claim, when someone asks to see the plan.

What "documented" means

Documented means written down, dated, and findable by someone other than the author. A plan that lives in the owner's head, or in an email thread from three years ago, is not documented in any sense an adjuster is likely to accept.

For a small firm, documented can be short. A single page listing each critical function, who performs it, who backs them up, where the logins and instructions live, and the date it was last checked. What makes it documented is not length. It is that a stranger could pick it up and act on it.

Evidence vs. assertion

An assertion is a sentence: we have backups for key roles. Evidence is something that shows it: a table naming the backup for each role, a record that the backup ran payroll last quarter, a screenshot of the second owner on the finance mailbox.

Evidence ages. A plan dated two years ago that names someone who has since left is weaker than it looks, because it shows the firm wrote a plan and then stopped looking. The cheapest way to keep evidence fresh is to build it from systems that already change when people do. Your Microsoft 365 directory, group ownership, and admin roles update when staff come and go, so a plan drawn from them can be re-checked in minutes instead of rewritten.

Answering honestly

If the honest answer is no, or partly, say so and describe what you are doing about it. Many questionnaires leave room for comments. A line such as 'plan in progress, key roles identified, backups assigned for payroll and banking, full review scheduled' is easier to defend than an unqualified yes.

Misstating facts on an application can give a carrier grounds to dispute a claim. Read your policy and ask your broker how the answers are used. Then close the gap between the answer you want to give and the one you can support, before renewal rather than after an incident.