The renewal packet lands about thirty days out, usually forwarded by your broker with a note that says “same as last year, mostly.” Twelve pages or so, checkboxes, a signature block at the end. Somewhere around page four your cursor starts circling a box: Is multi-factor authentication enforced for all users? And you’re doing the small arithmetic of what “all” means and whether it’s true.
Before you check anything, it helps to know this form has two readers.
The first one reads it soon, at a desk, pricing your next year. That reading is quick and forward-looking, and it’s the one everybody writes for.
The second reader may never exist. They only turn up after a very bad week: the transfer that went somewhere wrong, the Monday the files wouldn’t open. If that week ever comes, the answers you’re writing now get read again, slowly, next to the facts of the week, because the questionnaire is part of the record your policy sits on. Call that reader the adjuster. On a hard claim it may be several people with different titles, but the titles don’t matter; the slowness does. Nobody reads a form as carefully as someone deciding what happened.
This guide is for writing to the second reader. The discipline is deposition prep: say only what’s true, say it precisely, and volunteer no adjective you can’t back.
The second reading
A few habits define it, and you can borrow every one.
The second reader reads in the present tense. A checked yes says “this is how the firm runs, every day, as of this signature.” The rollout you’re planning for October has no box. If the form offers a space for work in progress, use it, because the yes box has no future tense.
They put weight on the small words. All. Tested. Written. Regular. On the first reading those words are furniture; on the second, each one is load-bearing and gets its own interview. That’s how the rest of this guide is organized, one loaded word at a time.
And they set answers next to whatever exists in writing. Reports, logs, invoices, dates. An answer that matches the paper trail is a boring answer, and on that particular day, boring is the entire goal.
One more thing before the walk: the wording below is representative. Every carrier writes its own form, and the shapes repeat anyway.
All
Is multi-factor authentication (MFA) enforced for all users, including email, remote access, and administrative accounts?
If it feels like the form asks about MFA from three directions, it does that on purpose; it’s the control renewals have leaned on hardest in recent years. The form’s favorite word here is all, and answering it honestly starts with a census, because “all” includes the accounts nobody thinks of as people. The shared mailbox the scanner sends through. The bookkeeper who works from her kitchen on Thursdays. The remote-access tool your IT provider uses to help you. The administrator login created years before anyone’s current tenure. On the second reading, all means all, and an account that got skipped because it was awkward is an uncomfortable thing to explain in that room.
So run the census this week, while the thirty days are still fat. Where MFA is missing, turning it on is usually the cheapest fix on the whole form. An exception you disclosed is a detail; an exception somebody else discovers is a story. Where something truly can’t do it (the ancient scanner login, the software that predates the idea), say so in one plain sentence wherever the form leaves room.
Monitored
Do you use endpoint detection and response (EDR), monitored 24/7?
Two claims share that sentence, deployed and watched, and the second reader will pull them apart.
EDR, in plain words: software on each computer that records what the machine is doing, raises an alarm on behavior that looks wrong, and can cut a machine off from the network while someone checks. It replaced what most of us grew up calling antivirus. Deployed is a counting question: is the number on the console the same as the number of machines that exist, including the loaner in the closet?
Monitored is a staffing question. It means a person or a service answers the alarm, at 2 AM too. If the software is installed but the alerts go to an inbox nobody opens, the true answer to “monitored” is no, and the fix is arranging the watching, which is a normal, buyable thing. On the second reading, monitored means names and timestamps: who was on the hook when the alarm went off.
Tested
Are backups encrypted, kept offline or immutable, and tested? Date of last successful restore test:
One checkbox wearing four promises. Encrypted is usually the easy one; the mainstream platforms do it by default. Offline or immutable, in plain words: at least one copy that your own administrator password cannot alter or delete, so an intruder who wins your credentials still can’t reach the copy that saves you. And tested is the word that decides the family, because a backup that has never been restored is a monthly bill and a hope.
Then the form does you a quiet favor: it asks for a date. A date line is the rare question that tells you exactly what evidence it wants. Restore something real this month, write the date down, keep the result with your copy of the form. On either reading, that fresh date may be the most convincing thing on the application.
Written
Does the organization maintain a written and tested incident response plan?
Written means producible: a dated document somebody could put in front of you within the hour. The plan that lives in the owner’s head fails that test whenever the owner is on a plane. One page carries most small firms: who gets the first call, who can spend money at 7 AM on a Saturday, and the claim-notice contact copied out of your own policy documents, so the plan and the policy point at each other. As for tested, a yearly read-through around a table counts on most forms if it actually happened and has a date. Note who sat in.
Regular
Is security awareness training provided to all employees on a regular basis?
“Regular” has a calendar and “all” has a headcount, so the truthful yes is a dated session log with names on it. If the most recent date you can produce is “sometime after the thing with the invoice,” book a session now and answer with the date on the calendar.
End of life
Does the organization run any software or operating systems that are end-of-life or no longer supported?
This is the row where wishful memory does the most damage, because everybody forgets the machine that still works. The box running the phone system. The computer the big scanner is married to. The practice-management version that only runs on the old server. End-of-life means the maker has stopped issuing fixes, so whatever hole is found next stays open, and the second reader likes this question because it has no gray in it: a version number either receives updates or it doesn’t.
Answer from an inventory, the same census you ran for “all.” If something old has earned its keep and has to stay, the credible answer names it, fences it off from the rest of the network and from client data, and puts a retirement date next to it that you intend to keep. Write that wherever the form gives you room. Quietly omitting the machine because it’s embarrassing hands the second reader the exact kind of surprise the whole form exists to prevent.
The thirty days
A month is enough time to change some answers instead of merely confessing them. So read the packet the week it arrives, and sort the rows into what’s already true, what a month can make true, and what will still be gray on signing day.
Already true: answer with dates and file the paper that proves it. A month can make true: the MFA stragglers, a real restore with a real date, the one-page plan, the booked training session. All four fit inside a month at most offices when the decision happens early instead of the night before. Still gray on signing day: write the plain version with a date attached, never the hopeful version with no date.
Our other guides call this writing the floor instead of the ceiling. On this form the rule comes out even simpler: sign the firm that exists when nobody’s watching, and let this year’s improvements arrive as next year’s better answers.
Two boundaries before you sign. Everything above is about making your answers true; what the answers mean for coverage, price, or a claim is a different craft, and it belongs to your broker or agent. Bring them the gray rows with the real facts attached, and let them ask the carrier what a word means before you commit to it. That question costs nothing before you sign. And if the technical rows are the ones staring back at you, bring the form to us before you fill anything in. We’ll read it with you against what your systems actually show, and you’ll know what’s true today, what a month can fix, and what to say about the rest.