Cyber insurance evidence package checklist

Updated July 20, 2026. This checklist is for executives, finance leaders, IT directors, compliance owners, and risk managers preparing for cyber insurance renewal or trying to prove that security questionnaire answers match the real environment.

What should a cyber insurance evidence package include?

A cyber insurance evidence package should include current proof for identity controls, endpoint protection, backup validation, vulnerability remediation, incident response readiness, security awareness training, vendor risk, and policy ownership. The evidence should be specific enough that underwriters, executives, and technical owners can see which controls are operating and which gaps still need remediation.

How should the evidence package be used?

Start the package before the renewal application arrives. Assign one owner for each control category, collect the artifacts below, and label every gap as resolved, in progress, accepted risk, or needing executive decision. This makes the renewal conversation cleaner and gives leadership a more accurate view of operational risk.

1. Set the renewal deadline, carrier requirements, and internal approval owners.
2. Collect evidence from identity, endpoint, backup, vulnerability, training, and vendor systems.
3. Match every questionnaire answer to a current artifact or documented exception.
4. Prioritize gaps that affect ransomware, business email compromise, regulated data, and recovery capability.
5. Keep a dated copy of submitted answers, supporting proof, and post-renewal remediation owners.

Identity and Access

• MFA coverage report for Microsoft 365, VPN, remote access, privileged accounts, and core business applications.
• Privileged access list with account owners, last review date, break-glass rules, and disabled stale accounts.
• Conditional access or sign-in risk policies that show how risky logins, legacy authentication, and impossible travel are handled.
• Joiner, mover, and leaver workflow evidence showing how access changes are requested, approved, and removed.

Endpoint, Patch, and Vulnerability Controls

• EDR or managed endpoint protection deployment report with exceptions and remediation owners.
• Patch compliance summary for servers, workstations, network devices, and business-critical applications.
• Vulnerability scan or risk register showing severity, age, remediation status, and accepted-risk approvals.
• Device inventory that separates managed endpoints, servers, network assets, cloud workloads, and unsupported systems.

Backup and Recovery Proof

• Backup coverage map for servers, Microsoft 365, SaaS systems, line-of-business applications, and critical file stores.
• Recent restore-test evidence with date, system tested, outcome, failure notes, and owner signoff.
• Retention and immutability settings, including where backup admin access is protected from ransomware.
• Recovery priority list that connects technical restore order to business operations and compliance needs.

Incident Response and Communications

• Incident response plan with declaration authority, first-hour owners, legal and insurance contacts, and escalation paths.
• Ransomware containment checklist covering identity, endpoints, network isolation, backups, evidence, and communications.
• Tabletop exercise notes or decision log showing which gaps were found and who owns remediation.
• Customer, employee, vendor, and executive communication templates reviewed by the right business owners.

Security Awareness and Vendor Risk

• Security awareness training completion records and phishing simulation trends for users with business system access.
• High-risk vendor list with data access, admin access, contract owner, and review cadence.
• Third-party remote access controls, including MFA, named accounts, logging, approval, and offboarding evidence.
• Policy acknowledgments for acceptable use, password management, data handling, and payment or wire-transfer controls.

What makes evidence weak?

Weak evidence is vague, stale, incomplete, or disconnected from ownership. A policy document is not enough if there is no operating proof. A backup dashboard is not enough if restore tests are missing. An MFA statement is not enough if privileged accounts, VPN, and third-party access are excluded.

• Reports without dates, scope, exceptions, or remediation owners.
• Security tools deployed broadly but missing executive, service, vendor, or admin accounts.
• Backups marked successful without restore testing or ransomware isolation details.
• Incident response plans that name tools but not decision authority, counsel, insurer contacts, or communications owners.
• Vendor access that is shared, unmanaged, or not removed when projects end.

Where should teams go next?

Use this checklist with Datapath's managed cybersecurity services, cybersecurity risk assessment services, incident response retainer services, and ransomware incident response playbook. For finance-specific fraud exposure, review financial services cybersecurity services and secure financial data transfer.

Frequently asked questions

What is a cyber insurance evidence package?

A cyber insurance evidence package is a set of current artifacts that prove security controls are operating before underwriting, renewal, or a claim. It usually includes MFA coverage, endpoint protection, backup testing, incident response contacts, security training, vulnerability remediation, and vendor risk documentation.

When should a business prepare cyber insurance evidence?

A business should prepare cyber insurance evidence 60 to 90 days before renewal, after major system changes, before adding regulated data workflows, and whenever leadership wants proof that stated controls match actual IT operations.

Which evidence do underwriters commonly ask for?

Underwriters commonly ask for MFA status, EDR deployment, backup and restore testing, patch and vulnerability reports, incident response plans, security awareness training records, privileged access controls, and third-party risk management details.

Can Datapath help prepare for cyber insurance renewal?

Yes. Datapath helps organizations organize control evidence, close security gaps, validate backups, document incident response roles, and prepare clearer renewal conversations for managed IT, cybersecurity, healthcare, education, finance, and municipal environments.