Cyber insurance applications rarely ask for documentation at the moment you sign them. The request comes later — at renewal, or during a claim investigation — and by then the standard of proof is a great deal less friendly. This checklist works backwards from that moment. For each question, you are not asked whether you have the control. You are asked whether you could put the artifact that proves it in front of an adjuster this week.
A tick box records what you believe is in place. It cannot record whether you could demonstrate it eighteen months after the fact, which is the only version of the answer that matters once a claim is open. So every row here has three states instead of two — and the gap between "we do that" and "we can prove we did that" is the number this tool exists to show you.
It is also the most exposed, because nothing feels wrong until someone asks. Your security may be genuinely good and your file still empty. That is a documentation problem, not a security problem, and it is usually far cheaper to fix than buying another tool.
Each question carries its real reference — SOC 2 Trust Services Criteria, NIST CSF 2.0, CIS Controls v8 — so you can hand a gap straight to whoever owns that control. These are the same categories our Argos GRC platform tracks for the clients we manage.
Your results list the specific artifact to produce for every outstanding row, ordered so the foundation items come first. Print it or save it as a PDF from your own answers, and it becomes the working document for your next renewal.
Read the list end to end and it resolves into a single underwriting concern: if an attacker obtains one working sign-in to this environment, how much does it get them, and for how long? The technical name for the underlying problem is standing privilege — accounts that hold elevated rights continuously, whether or not anyone is actively using them. Reduce standing privilege and most of this checklist starts answering itself, because the artifacts become a by-product of how access is granted rather than something you have to go and assemble.
That is also why the questions cluster the way they do. Rows nine, eleven and twelve — your privileged account inventory, your audit trail, and whether you can actually export it — underpin most of the others. If you are starting from a low score, start there, not at row one.
No. It is drafted against the privileged-access themes that recur across major carriers' applications, expressed in the way underwriters tend to ask them. Your carrier's wording will differ and may include questions specific to your industry or policy. Always answer from your actual application, not from this page.
No. It runs entirely in your browser on your own answers, and nothing is sent to us unless you choose to submit your results at the end. Your progress is saved locally on your device so you can finish it later.
Because an application response is a statement of fact on a specific date, and an inaccurate one can affect how a claim is handled regardless of how good your security actually is. That is not a reason for alarm — it is a reason to check your answers before you commit to them rather than afterwards.
You still sign the application, so the evidence obligation is still yours. It is a fair and reasonable thing to ask your provider which of these fifteen artifacts they can produce for you on request, and how long each would take. If the answer is vague, that is useful to know well before a renewal.
No. It is a free preparation aid, not legal, insurance, underwriting or compliance advice, and it produces no coverage determination, quote or guarantee. Verify every answer against your own environment and policy, and speak to your broker, carrier and counsel before relying on any of it.
We do. We run our own environment against the SOC 2 Trust Services Criteria and hold an SMB1001 Bronze certification, and our control status is published openly on our live Trust Center rather than described in a brochure. You are welcome to check our evidence before trusting us with yours.
That is good news, because it is the cheaper of the two problems to solve. In a 20-minute call we will walk your outstanding rows, tell you which artifacts you can already produce from systems you own today, and scope what it takes to generate the rest on a schedule instead of in a panic.
