What Irish Cyber Insurers Ask Before They Quote, and How to Be Ready

The controls that come up again and again

1. Multi-factor authentication on email and all remote access.
2. MFA, with separate logins, on administrator accounts.
3. Backups that ransomware cannot reach (offline or immutable), with a restore tested in the last year.
4. Managed endpoint protection on every computer and server.
5. Critical security updates applied promptly, including firewalls and routers.
6. Email filtering and regular staff awareness training.
7. A written incident response plan that includes calling your insurer.
8. A rule that supplier bank detail changes are verified by phone.
9. No unsupported software. Windows 10 reached the end of standard support in October 2025.

Why they ask

Insurers see the same handful of weaknesses behind many claims, so they use these questions to separate businesses that are reasonable risks from those that are not. Missing MFA or untested backups are the ones most likely to lead to a refusal, a higher premium or a policy exclusion.

Answer honestly

Proposal forms are legal documents. A confident yes to a control you do not really have can give an insurer grounds to dispute or reduce a claim later. If you are unsure, say so, fix the gap, and talk to your broker about what is mandatory with your insurer. This is general information, not insurance advice.

Before you apply or renew

1. Work through our cyber insurance readiness checklist to find your gaps.
2. Fix the high-impact items first: MFA, backups and endpoint protection.
3. Gather evidence: screenshots of MFA policies, a recent restore log and patch reports.
4. Ask your broker which controls your insurer treats as conditions of cover.