Cyber Insurance Application Readiness Kit

Your broker hands you a ten-page questionnaire. Some of the answers are yes, some are no, and a lot of them are sort of — MFA is on email but not the VPN, backups run nightly but nobody has restored one since 2024. This kit is for those answers, because "yes" to a half-enforced control is the fact a carrier denies the claim on.

Written for owners and office managers of 10–250 person businesses, and the MSPs and brokers who do this for them. You do not need a security team to use it.

01 Pre-Application Self-Assessment (XLSX) — 37 controls, each rated RED / AMBER / GREEN against a stated rule so two people rating the same business land in the same place. It is not a flat checklist: every control carries the carrier's own tier — pass/fail (missing it commonly means a decline), rated (weak means higher premium, deductible or sub-limit), or credit (documented may earn 5–10%). The Fix-first sheet sorts by that tier, then RED before AMBER, then weight, so what you see at the top is "restore-test your backups", not "consider a SIEM". The verdict cell returns one of four plain-English outcomes: NOT READY, BORDERLINE, INSURABLE, READY.

02 Carrier Questionnaire Crosswalk (XLSX) — how the same question is worded across carrier forms, the control behind it, the evidence that proves it, and where that evidence lives.

03 Evidence Checklist & Binder Index (XLSX + Evidence-Binder-Skeleton.zip) — one artefact per control, and a ready-made folder tree of 16 numbered directories with a README in each. Unzip it, fill it as you remediate, and the binder is built by the time you apply.

04 What Gets You Declined or Sub-Limited (PDF) — how underwriters actually score, the 12 answers that end the conversation, what misrepresentation means in practice, and how to work with an MSP who holds half your evidence.

05 Attestation-Safe Answer Bank (DOCX) — truthful wording for every control state — full, partial, absent — across 15 controls. This is the file that does what no competing listing does: it gives you language for the partial state, so you disclose accurately and still present well, instead of choosing between a lie and a blank.

06 30-Day Remediation Plan + Tracker (DOCX + XLSX) — a day-by-day plan with owners and cost bands, and a tracker with status and evidence flags. Week one is MFA, EDR and backups, which for most businesses is mostly configuration rather than spend.

07 Broker Email Templates (DOCX) — six drafts: pre-application, questions to ask when quotes arrive, partial-control disclosure, prior-incident disclosure, the MSP evidence request, and post-bind conditions.

08 Renewal Tracker (XLSX) — expiry countdown with computed milestones, the year-over-year questionnaire delta, and control history — because the controls you attested to are the ones you have to still have at renewal.

Where this sits. Three products, three jobs. The Cyber Insurance Readiness Checklist is the fifteen-minute look that tells you whether to worry. The Cyber Insurance Workbook is the 167-formula tool for a security team running insurance as an ongoing programme. This kit is the application itself — the deepest of the three, because getting bound is the part with the evidence binder, the answer bank and the broker correspondence in it. If you are doing both — applying now and managing it after — the Cyber Insurance Complete bundle is the two together.

Carriers also ask for written policies — acceptable use, access control, backup and DR, incident response, remote work. Those are ready-made at generatepolicy.com and cyberpolicy.shop, and IR runbooks are in the Incident Response Runbook Library.

Control readiness, not insurance advice. This helps you hold controls and describe them truthfully. Your broker advises on limits, terms, sub-limits and exclusions; counsel advises on warranties. The sub-limits section tells you what to ask your broker, not what to buy.