Insurance and clients

Cyber insurance and client questionnaires: what you will be asked.

Before covering you, a cyber insurer asks questions about your risk and expects basic measures: backups, protection against malware, secure remote access, updates, access rights and emergency procedures. Your clients ask for the same things in their security questionnaires. In both cases, you have to answer truthfully and be able to prove it.

What do you need in place to be insurable?

There is no single list: each insurer has its own questionnaire and terms. The Swiss Insurance Association nevertheless writes that basic security measures are required before taking out any cyber insurance. It relays six measures from the Swiss Cyber Defense DNA association, specifying that they are not minimum requirements but a checklist to refine with the insurer, the broker or the IT provider.

The table takes these six measures and links them to what Ryze Cyber describes on its website. An empty box is better than a promise: what is not published on the website is noted as such.

Measure (list relayed by the Swiss Insurance Association)	Free scan question	Red Team (test)	Blue Team (protection)
1. Up-to-date, unalterable backup, restore tested	"Your backups are tested (you have already restored a file)"	Not applicable: Blue Team area.	Protection plan: hardening of access and backups.
2. Protection against malware and staff training	"The team has been trained to spot a fraudulent email"	"Email and phishing" area.	Protection plan: team awareness. Installing antivirus software is not described on the website: check with your IT provider.
3. Secure networks and remote access (two-factor authentication, VPN, separate guest Wi-Fi)	"Two-factor authentication is switched on for your email and key tools"	Full audit: manual web and access tests. "Network and Wi-Fi" area.	Protection plan: hardening of access.
4. Up-to-date hardware and software	"Updates to computers and the website are done every month"	External scan: exposed website and services seen from the internet.	Watch plan: monthly check of exposed points.
5. Staff roles and access rights	"Administrator rights are limited to a few people"	"Accounts and access" area: passwords, two-factor authentication, rights.	Protection plan: hardening of access.
6. Emergency procedures defined and known	"You know who to call and what to do in case of an attack"	Not applicable: Blue Team area.	"Incident response" area: knowing who calls whom, before the day it happens.

The plans and their prices are published on the home page. For the overall logic, see Red Team and Blue Team.

What happens if I answer the insurer's questionnaire wrongly?

The risk questionnaire is not a formality. The terms of one Swiss insurer show it well: those of Baloise's cyber insurance for small businesses (2025 edition, in French) state that the policyholder must answer the risk questions truthfully and completely. In the event of a culpable breach, the insurer may terminate the contract. If the breach affects the occurrence or the extent of a claim, it may reduce or even refuse its benefits.

Two practical consequences:

Only tick "yes" for what is really in place today. "Planned" is not "done".
Keep dated proof of each "yes": a screenshot of the setting, a restore log, a test report.

Read the terms of your own contract: they alone are binding for your cover, and they differ from one insurer and one country to another.

How do you answer a client's security questionnaire?

A client often sends you a questionnaire because the law asks it to make sure of its suppliers. In Switzerland, the controller must ensure that its processor is able to guarantee data security (FADP, Article 9). In the European Union, the NIS2 directive requires regulated entities to manage the security of their supply chain (Article 21). See the details on the legal obligations page.

A six-step method:

Read everything before answering. Sort each question: yes, no, partly, not applicable.
Answer truthfully. A "no" with a date for the fix goes down better than a "yes" you cannot prove.
Attach proof. A recent test report is one: the Ryze Cyber report contains a summary for management, the scope and its limits, the flaws by severity and a remediation plan in order of priority.
Give a plan for each "no". Who fixes what, by when.
Ask what is blocking. Not every point carries the same weight for your client. Ask the question.
Keep a master version. The next questionnaire will cover the same topics.

Can my client require ISO 27001 certification?

It is a contractual requirement: the client can make it a condition, and you can discuss it. Before committing to a certification, ask whether the client accepts other proof for a supplier of your size, for example a recent penetration test report with its remediation plan. The decision is the client's. Ryze Cyber does not issue certifications.

Where do you start, in practice?

With a step that costs nothing: the free scan. Its ten questions overlap with the topics of these questionnaires (access, data, team, AI tools and testing). In two minutes you see the "no" answers you will need to deal with before signing anything.

Frequently asked questions

Does a cyber insurer require a penetration test?

It depends on the insurer and on the size of the company. The list of measures relayed by the Swiss Insurance Association does not mention penetration testing. Ask your insurer or broker before taking out a policy.

Which measures does an insurer look at first?

The Swiss Insurance Association relays six measures: backups, protection against malware, secure networks and remote access, updates, staff roles and emergency procedures. Each insurer then has its own questions.

What is the risk of an inaccurate answer to the insurer's questionnaire?

The insurance terms we read (Baloise, 2025 edition) set a duty to answer truthfully and completely. In the event of a culpable breach, the insurer may terminate the contract and, if the breach affects the claim, reduce or refuse its benefits. Check the terms of your own contract.

Is a test report enough instead of ISO 27001?

Only your client can say. A recent report, with its scope and a remediation plan, is concrete proof to offer. It does not replace a certification if the contract requires one.

Does the Ryze Cyber free scan count as a certificate for an insurer?

No. It is an indicative self-assessment, calculated from your answers: nothing is tested on your systems. It helps you spot your weak points before filling in an official questionnaire.

Spot your "no" answers before the questionnaire.

The Ryze Cyber free scan is a 10-question questionnaire. It takes two minutes, the score appears straight away and nothing is tested on your systems.

Take the free scan →

Sources

Last updated: 7 October 2026