Cyber insurance used to be a box you ticked. Now the renewal questionnaire is doing real underwriting, and the questions are specific because the insurers have paid enough claims to know where the losses come from. The three that matter most are multi-factor authentication, whether your backups are tested, and whether you have any kind of incident plan. Answer those badly and the premium goes up, or the cover narrows in ways you only discover when you claim.

Multi-factor authentication is the one that swings the number hardest. The insurer is asking whether an attacker who steals a password gets straight in, or hits a second step. If MFA is on for email and for remote access, you answer yes with a clear conscience. If it is on for “some accounts”, the honest answer is no, and it is worth fixing before you fill the form in rather than after.

The backup question is not “do you have backups”, because everyone says yes. It is “when did you last restore one and check it worked”. A backup nobody has ever restored is a hope, not a control, and insurers know the difference. Restoring a test file to a spare folder once a quarter turns a weak answer into a strong one, and it is an hour of work.

The incident plan question sounds like the sort of thing only big firms have. It is not. A single page - who to ring, which supplier holds what, where the backups are, who tells customers - is enough to answer honestly and enough to be useful at three in the morning. The point of answering these well is not a cheaper premium, though it helps. It is that the same three things are what actually save you when something goes wrong.