Cyber Insurance Readiness Sample Report
What you receive, shown on Larkspur Point Advisors, a fictional firm with illustrative data: every application answer checked against real evidence.
Every security answer, checked against the evidence
Supported, partly supported or not supported as written, with the reason and the fix.
A plan that fits the renewal deadline
What to fix before submission, before renewal and after, ranked by underwriting relevance and effort.
Six deliverables from one readiness review
This cyber insurance readiness sample report walks through each deliverable of our cyber insurance readiness assessment, using a fictional firm.
| Deliverable | What it contains | Who uses it |
|---|---|---|
| Executive readiness summary | Overall readiness, top gaps and deadline-sensitive priorities | Owner, CEO, managing partner |
| Application-answer review notes | Each security question, the planned answer, what we found and the evidence status | Leadership, broker conversation |
| Remediation roadmap | MFA, EDR, backup, vulnerability, access and response items by phase | IT manager, IT provider |
| Evidence checklist | Reports, policies, screenshots, tests and inventories to keep on file | Office manager, IT |
| Questions to clarify | Wording or scope questions for the broker, insurer or legal advisor | Owner, broker |
| Optional follow-up check | A second review before submission or renewal | Leadership, broker |
Cyber insurance readiness report at a glance
Larkspur Point Advisors planned to answer “yes” to eight of nine security questions. The evidence supports two of them fully. The most urgent gap is endpoint detection: seven workstations and two servers are not covered, so the EDR answer should not be submitted as written. Most other gaps can be closed or documented before renewal.
Every answer, checked against evidence
| # | Application question | Planned answer | What we found | Evidence status | Priority |
|---|---|---|---|---|---|
| 1 | Is MFA required for all remote access? | Yes | VPN requires MFA. One vendor’s remote support tool connects without MFA. | Partly supported | High |
| 2 | Is MFA enforced on email for all users? | Yes | Enforced by Conditional Access, with three accounts excluded. | Partly supported | High |
| 3 | Is MFA required for administrator accounts? | Yes | All five administrator accounts require MFA; report exported. | Supported | — |
| 4 | Is EDR deployed on all endpoints and servers? | Yes | 41 of 48 workstations report to EDR; two servers run antivirus only. | Not supported as written | Critical |
| 5 | Are backups kept offline or immutable? | Yes | Cloud backup is immutable for 30 days; no restore test recorded in 14 months. | Partly supported | High |
| 6 | Are critical patches applied within 30 days? | Yes | Workstations current; firewall firmware 11 months behind. | Partly supported | Medium |
| 7 | Do you have a written incident response plan? | Yes | Plan dated 2023, never exercised, missing broker and carrier contacts. | Partly supported | Medium |
| 8 | Do employees complete security awareness training? | Yes | Training records available for 44 of 45 staff. | Supported | Low |
| 9 | Do you run any unsupported operating systems? | No | One Windows 10 PC still runs the scanning software after end of support. | Not supported as written | High |
Evidence status reflects what was reviewed on the assessment date. See our questionnaire evidence guide for how each question is usually checked.
Sample finding
- Question
- Is endpoint detection and response (EDR) deployed on all endpoints and servers?
- Planned answer
- Yes
- What we found
- The EDR console lists 41 of 48 workstations. Seven laptops issued in the last year were never enrolled. Two file servers run traditional antivirus only.
- Evidence status
- Not supported as written Critical
- Why it matters
- Unmonitored devices are where ransomware and credential theft often go unnoticed, and an inaccurate answer can create problems if a claim is filed later.
- Recommendation
- Enroll the seven laptops and both servers, confirm they report, and export the coverage report. If any device cannot be covered before submission, discuss how to describe the exception with the broker.
- Evidence to keep
- EDR coverage report showing all devices, device inventory, and a dated note of the change.
- Owner and target
- IT provider · before submission (within 14 days)
What to keep on file before submission
An excerpt of the checklist. The full list follows our documents, policies and evidence checklist.
| Evidence item | Where it comes from | Status |
|---|---|---|
| MFA policy and coverage report | Microsoft Entra ID Conditional Access | Incomplete |
| Administrator role list with MFA status | Microsoft Entra ID | Supported |
| EDR device coverage report | EDR console | Not supported as written |
| Backup job status and immutability setting | Backup platform | Supported |
| Most recent restore test record | IT provider | Not supported as written |
| Patch compliance and firmware versions | RMM tool, firewall | Partly supported |
| Incident response plan with contacts | Policy library | Partly supported |
| Security awareness training records | Training platform | Supported |
A plan that fits the renewal date
Phases follow the renewal deadline, not a generic calendar. Our renewal readiness roadmap explains the approach.
SAMPLE · Larkspur Point Advisors (fictional company) · illustrative data
Correct what the application says
Enroll the remaining devices in EDR, remove the three MFA exclusions, require MFA on the vendor remote tool, and review any answer that still cannot be supported with the broker.
Close the high-priority gaps
Run and document a restore test, update firewall firmware, and replace or isolate the Windows 10 scanning PC.
Make it hold for next year
Update the incident response plan with broker and carrier contacts, run a tabletop exercise, and refresh the evidence file every quarter.
Questions for the broker, insurer or legal advisor
Some questions are about wording or scope, not technology. The report lists them so the right person answers them before submission.
- Does “all remote access” include a vendor’s remote support tool?
- Does the carrier treat immutable cloud backup as an offline backup?
- How should a device that cannot be covered by EDR before submission be described?
- Does the policy require specific incident response or forensics vendors?
Read before your next application or renewal
Working with clients as a broker? See how we work with insurance brokers.
Guided by Ali Hassani, CISO
Every readiness report is reviewed by Ali Hassani, a CISO with more than 25 years of IT and cybersecurity experience, so findings are accurate and written for owners, IT teams and brokers alike.
- Certified CISO (C|CISO) and CISSP
- 25+ years in IT, networking and cybersecurity
- Microsoft and Cisco certifications, including CCNP, CCNA, MCSE, MCITP and MCSA Security
- Based in Irvine; on-site across Orange County, Los Angeles and Southern California; remote nationwide
Frequently asked questions
Is this a real client's report?
No. Larkspur Point Advisors is a fictional company and every number on this page is illustrative. Real client reports are confidential and are never published.
Does a “Supported” result mean the insurer will accept the answer?
No. It means the evidence we reviewed supports the answer as written on the day of the review. Underwriting decisions belong to the insurer.
Do you change or submit our application?
No. We show where the planned wording and the evidence do not match. You and your broker decide what to submit.
How long before renewal should we start?
The earlier the better. More than 60 days before renewal leaves time to close gaps; a shorter window is still useful to correct answers and organize evidence.
Can you check again after we fix the gaps?
Yes. An optional follow-up readiness check before submission or renewal confirms which items are now supported.
Who uses each part of the report?
Owners and executives use the summary, IT teams and providers use the findings and roadmap, and the broker conversation uses the answer review and questions to clarify.
Need the gaps fixed, not just found?
OC Security Audit stays independent and read-only. If you want hands-on administration, IT Perfection can implement the fixes and support ongoing operations. Your current IT provider can also work from the same roadmap.
Know which answers you can support, before the underwriter asks
Schedule a consultation. We review your questionnaire and environment, then send a written scope and quote.
Independent assessment only. We do not sell insurance, interpret policy terms or guarantee coverage, premium or claim outcomes. Irvine, Orange County and Southern California on-site; remote nationwide.