- Step 1 of 11

1. GENERAL INFORMATION

Applicant Name *

Company Name *

Address: *

Address 2:

City: *

State *

Zip Code: *

Email: *

Website: *

Phone: *

Fax:

2. FORM OF BUSINESS

a. Applicant is a(an) *

Individual
Corporation
Partnership
Other:

Other:

b. Date Established *

c. Total number of employees: *

d. Description of operations: *

e. Please attach a list of all subsidiaries, affiliated companies or entities owned by the Applicant. Please describe (1) the nature of operations of each such subsidiary, affiliated company or entity, (2) its relationship to the Applicant and (3) the percentage of ownership by the Applicant.

Click or drag a file to this area to upload.

3. REVENUES

Total gross revenues:

Current Fiscal Year ending / (current projected) *

Last Fiscal Year ending

Two Fiscal Years ago ending

4. RECORDS

a. Do you collect, store, host, process, control, use or share any private or sensitive information* in either paper or electronic form? *

If “Yes”, please provide the approximate number of unique records:

Paper records:

Electronic records:

*Private or sensitive information includes any information or data that can be used to uniquely identify a person, including, but not limited to, social security numbers or other government identification numbers, payment card information, drivers’ license numbers, financial account numbers, personal identification numbers (PINs), usernames, passwords, healthcare records and email addresses.

b. Do you collect, store, host, process, control, use or share any biometric information or data, such as fingerprints, voiceprints, facial, hand, iris or retinal scans, DNA, or any other biological, physical or behavioral characteristics that can be used to uniquely identify a person? If “Yes”, have you reviewed your policies relating to the collection, *

If “Yes”, have you reviewed your policies relating to the collection, storage and destruction of suchinformation or data with a qualified attorney and confirmed compliance with applicable federal, state, local and foreign laws?

Reviewed Policies

c. Do you process, store or handle credit card transactions? *

If “Yes”, are you PCI-DSS Compliant?

Reviewed Policies (copy)

5. IT DEPARTMENT

This section must be completed by the individual responsible for the Applicant’s network security. As used in this section only, “you” refers to the individual responsible for the Applicant’s network security.

a.

Who is responsible for the Applicant's network security?

Name: *

Title: *

Phone: *

Email Address *

IT Security Designations(s):

b. The Applicant’s network security is: *

Outsourced
Managed internally/in-house

d. How many dedicated IT security personnel are on your team? *

By continuing with the application, you confirm that you have reviewed all questions in this application regarding the Applicant’s security controls, and, to the best of your knowledge, all answers are complete and accurate.

6. EMAIL SECURITY CONTROLS

If the answer to any question in this section is “No”, please provide additional details in the “Additional Comments” section.

a. Do you tag external emails to alert employees that the message originated from outside the organization? *

b. Do you pre-screen emails for potentially malicious attachments and links? *

If “Yes”, do you have the capability to automatically detonate and evaluate attachments in a sandbox to determine if they are malicious prior to delivery to the end-user?

Pre-screen Emails

c. Have you implemented any of the following to protect against phishing messages? (Please check all that apply): *

Sender Policy Framework (SPF)
DomainKeys Identified Mail (DKIM)
Domain-based Message Authentication, Reporting & Conformance (DMARC)
None of the above

d. Can your users access email through a web application or a non-corporate device? *

If “Yes”, do you enforce Multi-Factor Authentication (MFA)?

MFA

e. Do you use Office 365 in your organization? *

If “Yes”, do you use the Office 365 Advanced Threat Protection add-on?

MFA (copy)

ADDITIONAL COMMENTS

(Use this space to explain any “No” answers in the above section and/or to list other relevant IT security measures you are utilizing that are not listed here.)

7. INTERNAL SECURITY CONTROLS

If the answer to any question in this section is “No”, please provide additional details in the “Additional Comments” section.

a. Do you use a cloud provider to store data or host applications? *

If “Yes”, please provide the name of the cloud provider:

Cloud Provider

If you use more than one cloud provider to store data, please specify the cloud provider storing the largest quantity of sensitive customer and/or employee records (e.g., including medical records, personal health information, social security numbers, bank account details and credit card numbers) for you.

b. Do you use MFA to secure all cloud provider services that you utilize (e.g. Amazon Web Services (AWS), Microsoft Azure, Google Cloud)?

c. Do you encrypt all sensitive and confidential information stored on your organization’s systems and networks?

If “No”, are the following compensating controls in place:

(1) Segregation of servers that store sensitive and confidential information?

(2) Access control with role-based assignments?

d. Do you allow remote access to your network?

e. Do you use a next-generation antivirus (NGAV) product to protect all endpoints across your enterprise?

If “Yes”, please provide your NGAV provider:

f. Do you use an endpoint detection and response (EDR) tool that includes centralized monitoring and logging of all endpoint activity across your enterprise?

If “Yes”, please provide your EDR provider:

g. Do you use MFA to protect access to privileged user accounts?

h. Do you manage privileged accounts using privileged account management software (e.g., CyberArk, BeyondTrust, etc.)?

If “Yes”, please provide the name of your provider:

i. Do you roll out a hardened baseline configuration across servers, laptops, desktops and managed mobile devices?

j. Do you record and track all software and hardware assets deployed across your organization?

If “Yes”, please provide the name of the tool used for this purpose (if any):

k. Do non-IT users have local administration rights on their laptop / desktop?

l. How frequently do you install critical and high severity patches across your enterprise?

1-3 days
4-7 days
8-30 days
One month or longer

m. Do you have any end of life or end of support software?

If “Yes”, is it segregated from the rest of your network?

n. Do you use a protective DNS service (e.g. ZScaler, Quad9, OpenDNS or the public sector PDNS) to block access to known malicious websites?

If “Yes”, please provide the name of your DNS provider:

o. Do you use endpoint application isolation and containment technology on all endpoints?

If “Yes”, please select your provider:

If “Other”, please provide the name of your provider:

p. Can users run Microsoft Office Macro enabled documents on their system by default?

q. Do you implement PowerShell best practices as outlined in the Environment Recommendations by Microsoft?

r. Do you utilize a Security Information and Event Management (SIEM) system?

s. Do you utilize a Security Operations Center (SOC)?

If “Yes”, is it monitored 24 hours a day, 7 days a week?

t. Do you use a vulnerability management tool?

If “Yes”, please select your provider:

If “Other”, please provide the name of your provider:

ADDITIONAL COMMENTS

(Use this space to explain any “No” answers in the above section and/or to list other relevant IT security measures you are utilizing that are not listed here.)

8. BACKUP AND RECOVERY POLICIES

If the answer to the question in this section is “No”, please provide additional details in the “Additional Comments” section.

Do you use a data backup solution? *

If “Yes”:

a. How frequently does it run?

Daily
Weekly
Monthly

b. Estimated amount of time it will take to restore essential functions in the event of a widespread malware or ransomware attack within your network?

0-24 hours
1-3 days
4-6 days
1 week or longer

c. Please check all that apply:

Backups are encrypted.
Backups are kept separate from your network (offline/air-gapped), or in a cloud service designed for this purpose.
Backups are secured with different access credentials from other administrator credentials.
You utilize MFA to restrict access to your backups.
You use a cloud-syncing service (e.g. Dropbox, OneDrive, SharePoint, Google Drive) for backups.
Your cloud-syncing service is protected by MFA.
You have tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months.
You are able to test the integrity of backups prior to restoration to ensure that they are free of malware.

ADDITIONAL COMMENTS

(Use this space to explain any “No” answers in the above section and/or to list other relevant IT security measures you are utilizing that are not listed here.)

9. PHISHING CONTROLS

a. Do any of the following employees at your company complete social engineering training:

(1) Employees with financial or accounting responsibilities? *

(2) Employees without financial or accounting responsibilities? *

If “Yes” to question 9.a.(1) or 9.a.(2) above, does your social engineering training include phishing simulation?

b. Does your organization send and/or receive wire transfers? *

If “Yes”, does your wire transfer authorization process include the following:

(1) A wire request documentation form?

(2) A protocol for obtaining proper written authorization for wire transfers?

(3) A separation of authority protocol?

(4) A protocol for confirming all payment or funds transfer instructions/requests from a new vendor, client or customer via direct call to that vendor, client or customer using only the telephone number provided by the vendor, client or customer before the payment or funds transfer instruction/request was received?

(5) A protocol for confirming any vendor, client or customer account information change requests (including requests to change bank account numbers, contact information or mailing addresses) via direct call to that vendor, client or customer using only the telephone number provided by the vendor, client or customer before the change request was received?

10. LOSS HISTORY

If the answer to any question in 10.a. through 10.c. below is “Yes”, please complete a Claim Supplemental Form for each claim, allegation or incident.

a. In the past 3 years, has the Applicant or any other person or organization proposed for this insurance:

(1) Received any complaints or written demands or been a subject in litigation involving matters of privacy injury, breach of private information, network security, defamation, content infringement, identity theft, denial of service attacks, computer virus infections, theft of information, damage to third party networks or the ability of third parties to rely on the Applicant’s network? *

(2) Been the subject of any government action, investigation or other proceedings regarding any alleged violation of privacy law or regulation? *

(3) Notified customers, clients or any third party of any security breach or privacy breach? *

(4) Received any cyber extortion demand or threat? *

(5) Sustained any unscheduled network outage or interruption for any reason? *

Please describe:

(6) Sustained any property damage or business interruption losses as a result of a cyber-attack? *

(7) Sustained any losses due to wire transfer fraud, telecommunications fraud or phishing fraud? *

b. Do you or any other person or organization proposed for this insurance have knowledge of any security breach, privacy breach, privacy-related event or incident or allegations of breach of privacy that may give rise to a claim? *

c. In the past 3 years, has any service provider with access to the Applicant’s network or computer system(s) sustained an unscheduled network outage or interruption lasting longer than 4 hours? *

If “Yes”, did the Applicant experience an interruption in business as a result of such outage or interruption?

AGENT INFORMATION

Agency Name *

Agent's Name *

Agent's Email Address *

Agent's Phone Number *

CERTIFICATION AND SUBMISSION

The Applicant has read the foregoing and understands that completion of this application does not bind the Underwriter or the Broker to provide coverage. It is agreed, however, that this application is complete and correct to the best of the Applicant’s knowledge and belief, and that all particulars which may have a bearing upon acceptability as a Cyber Liability Insurance risk have been revealed.

Applicant’s Name *

Applicant’s Title *

Cyber Liability Insurance Application

1. GENERAL INFORMATION

2. FORM OF BUSINESS

3. REVENUES

Total gross revenues:

4. RECORDS

If “Yes”, please provide the approximate number of unique records:

If “Yes”, have you reviewed your policies relating to the collection, storage and destruction of suchinformation or data with a qualified attorney and confirmed compliance with applicable federal, state, local and foreign laws?

If “Yes”, are you PCI-DSS Compliant?

5. IT DEPARTMENT

This section must be completed by the individual responsible for the Applicant’s network security. As used in this section only, “you” refers to the individual responsible for the Applicant’s network security.

a.

By continuing with the application, you confirm that you have reviewed all questions in this application regarding the Applicant’s security controls, and, to the best of your knowledge, all answers are complete and accurate.

6. EMAIL SECURITY CONTROLS

If the answer to any question in this section is “No”, please provide additional details in the “Additional Comments” section.

If “Yes”, do you have the capability to automatically detonate and evaluate attachments in a sandbox to determine if they are malicious prior to delivery to the end-user?

If “Yes”, do you enforce Multi-Factor Authentication (MFA)?

If “Yes”, do you use the Office 365 Advanced Threat Protection add-on?

7. INTERNAL SECURITY CONTROLS

If the answer to any question in this section is “No”, please provide additional details in the “Additional Comments” section.

If “Yes”, please provide the name of the cloud provider:

If “No”, are the following compensating controls in place:

8. BACKUP AND RECOVERY POLICIES

If the answer to the question in this section is “No”, please provide additional details in the “Additional Comments” section.

If “Yes”:

9. PHISHING CONTROLS

a. Do any of the following employees at your company complete social engineering training:

If “Yes”, does your wire transfer authorization process include the following:

10. LOSS HISTORY

If the answer to any question in 10.a. through 10.c. below is “Yes”, please complete a Claim Supplemental Form for each claim, allegation or incident.

a. In the past 3 years, has the Applicant or any other person or organization proposed for this insurance:

AGENT INFORMATION

CERTIFICATION AND SUBMISSION

US Pro

Cyber Source

Proud Member of

Email Newsletter