Cyber insurance questionnaire: the 12 prerequisites to be insurable (MFA, backups, EDR…)

A cyber insurance questionnaire checks around a dozen security measures, three of which are disqualifying in 2026: multi-factor authentication on every sensitive access point, detection on workstations and servers (EDR), and tested offline backups. Without those three, most insurers decline to quote, or cover you with exclusions that empty the policy of meaning. The other nine prerequisites do not decide whether you get access to the market, but they decide your premium, your deductible and your limits. The good news for a CTO: all of it can be put in place in a month, with evidence to back it up.

What is the cyber insurance questionnaire for, and why is it disqualifying?

The questionnaire is the risk declaration provided for in Article L113-2 of the French Insurance Code: the insurer asks precise questions, you answer, and it prices on that basis. It serves as an audit, without a site visit, in 20 to 80 questions.

It is binding. Article L113-8 punishes an intentional false statement with the nullity of the policy, premiums being kept by the insurer. Article L113-9 provides, for a good-faith omission discovered after a claim, a reduction of the indemnity in proportion to the premium that should have been paid. Ticking "MFA deployed" when it only covers email can therefore cost you the payout the day an admin account is hijacked.

What are the 12 cyber insurability prerequisites in 2026?

The same twelve measures come up among insurers active on the French SME market: three disqualifying, six that weigh on pricing, three that condition access to specific covers.

The logic of this ranking matches the 2025 Cyber Threat Panorama published by ANSSI in March 2026: of the 128 ransomware compromises it handled in 2025, 48% targeted micro, small or mid-sized companies, up from 37% a year earlier. The insurer wants to know whether you are the easy target in that statistic.

Why are MFA, EDR and backups the three disqualifying items?

Because they match the three stages of a ransomware attack: get in, move around, destroy. Multi-factor authentication (MFA) requires, on top of the password, a second proof of identity: a one-time code, a phone notification or a physical key. It neutralises most intrusions using stolen credentials, and account hijacking has become the leading threat to businesses according to Cybermalveillance.gouv.fr, with 21% of assistance requests in 2025, up 52%.

EDR (Endpoint Detection and Response) is an agent installed on every workstation and server that monitors abnormal behaviour, isolates a compromised machine and keeps a record of the attack, where classic antivirus only recognises known signatures. MDR adds a permanent monitoring team on top.

Offline or immutable backups are copies of your data that no attacker or compromised admin account can encrypt or delete: a disconnected medium, write-locked storage, or an isolated cloud vault. They are the only guarantee of restarting without paying a ransom. The insurer wants the date of the last full restore test.

A cyber questionnaire is not an exam to pass; it is the inventory of the evidence you will present the day you ask the insurer to pay.

How do you answer the questionnaire without weakening your policy?

Answer the question asked. "MFA on all remote access" means all, including the maintenance provider's VPN. If coverage is partial, say so and date the deployment plan: an insurer accepts a measure in progress with a deadline, it does not accept a surprise after a claim.

Attach dated evidence: EDR console export, conditional access policy, restore report, minutes of the crisis exercise. Have the questionnaire reviewed by the person who actually administers the infrastructure, and keep a signed copy: it is the document the loss adjuster will compare with reality after a claim.

How do you go from "declined" to "insurable" in 30 days?

A refusal signals the absence of one or more disqualifying items. For a company of 20 to 150 workstations on Microsoft 365 or Google Workspace, the following plan fits within a month.

This plan draws on ANSSI's IT hygiene guide, whose 42 measures cover the whole range of market questionnaires. For a scale-up, the same roadmap serves as the foundation for your enterprise customers' requirements and for NIS2 or DORA obligations.

How much does cyber insurance cost once the prerequisites are in place?

For a French SME, the orders of magnitude observed in 2026 range from €1,000 to €3,000 a year between 10 and 50 employees, and from €3,000 to €10,000 above that, for limits of €1 million to €5 million. At equal size, the gap between a complete file and a half-filled one is measured in tens of percent on the premium, and shows up in the deductible too.

AMRAE's LUCY 2026 study reports an average 32% fall in large-company premiums over 2025, but indemnified claims rising from €54.5 million to €83.2 million. Insurers offset that tension through selection: the prerequisites are the counterpart of low prices.

What happens at cyber policy renewal?

The questionnaire comes back every year, often expanded: immutable backups, log retention, service accounts, use of generative AI tools, supplier monitoring. A change of scope during the policy term (new subsidiary, cloud migration, headcount growth) must be declared within fifteen days (Article L113-2, 3°), failing which you fall back into the regime of Articles L113-8 and L113-9. SaaS companies are particularly exposed, as their customers demand an up-to-date certificate of insurance in parallel.

Frequently asked questions

Can an insurer refuse cyber insurance to an SME?

Yes, and frequently, when MFA, EDR or offline backups are missing. Once the three measures are in place, with dated evidence, the file can be resubmitted.

Is MFA mandatory to be insurable?

In practice yes, on remote access, email, admin accounts and cloud consoles. Some policies accept partial coverage with an exclusion of claims linked to unprotected accounts, which amounts to not covering the main risk.

What is the risk of a mistake in the questionnaire?

A good-faith error leads to a proportional reduction of the indemnity (Article L113-9 of the Insurance Code). An intentional false statement leads to the nullity of the policy (Article L113-8), with the insurer keeping the premiums.

Does an audit or certification replace the questionnaire?

No, but a recent audit or ISO 27001 certification eases underwriting and justifies a lower premium. The questionnaire remains your contractual declaration.

At Lesto, we read your questionnaire before the insurer does: we identify the answers that block, prioritise the measures that unlock a quote and present your file, evidence included, to nine insurers on average. Have you received a refusal, or a premium that does not reflect your security level? Discover our cyber insurance offer and get an analysis within 72 hours.