Cyber insurance readiness for Canadian businesses, with proof behind every answer

What cyber insurance readiness covers

Cyber insurance readiness is the work between receiving an insurer’s security questionnaire and signing it: finding out which controls the insurer asks about, checking whether each one is really in place on every account and device, collecting proof, and closing what can be closed before the deadline. The result is a set of answers that will still hold up if a claim is ever examined.

Many Canadian small firms meet this paperwork for the first time. In a survey of 308 owners and decision makers at companies with up to 500 employees, run in August 2025, the Insurance Bureau of Canada found that “just 22% carry cyber insurance, and only 12% have a dedicated stand-alone cyber insurance policy.”¹ The Bureau also warns that a traditional property and liability policy may include some cyber coverage, and that “these policies typically have very low limits that would not cover the full cost of a breach or cyberattack.”²

• A first application for a stand-alone cyber policy
• A renewal where the insurer has added new security questions
• A broker’s request to confirm multi-factor authentication or backups before a quote
• A client contract that requires you to hold cyber coverage

Cyber insurance requirements in Canada: the controls insurers ask about

Cyber insurance requirements in Canada come from each insurer’s own application, since no law sets a common list. Public documents from the market point to the same core: multi-factor authentication, protected and tested backups, endpoint detection, patching, staff training and a written incident response plan. The broker Marsh writes that “the adoption of certain controls has now become a minimum requirement of insurers.”³

The Canadian Centre for Cyber Security covers the same ground in its baseline controls for organizations with fewer than 500 employees, and its first control even asks organizations to consider a cyber security insurance policy that covers incident response and recovery, or to record why they chose to go without one.⁴ The table puts the two side by side, with the proof we gather for each line.

What a cyber insurance questionnaire asks beyond the technical controls

A cyber insurance questionnaire also asks about the business itself, and those answers come from you. The Government of Canada’s Get Cyber Safe campaign lists questions insurers may ask: how many employees and customers you have and how revenue breaks down, whether you have a dedicated chief privacy officer or chief information officer, what information you collect and whether you need all of it, and the annual budget for cyber protection.⁵

Two questions on that list connect directly to our work: “When was the last security and privacy audit performed and were all recommendations implemented?” and “What security measures do you have in place to prevent access to your facility and systems?”⁵ A dated security audit with a record of what was fixed answers the first. The second needs the same evidence as the controls table above.

The Insurance Bureau of Canada built a self-assessment around the questions insurers may ask; it covers your cyber risk, whether you collect and store customers’ personal information, the security procedures in place and how often employees receive cyber safety training.⁶

Why an accurate answer protects the claim

An answer on the application is a statement the insurer relies on, so an optimistic yes can return on the day you claim. When the City of Hamilton claimed for the cyberattack of 25 February 2024, its insurer rejected the claim because “multi-factor authentication had not been fully implemented at the time of the attack,” Global News reported on 31 July 2025.⁷

Partial coverage is the pattern we look for first. Multi-factor authentication is often on for staff and off for the owner, a shared mailbox, an old remote-access account or the account a backup program uses at night. Each of those turns a truthful-sounding yes into a gap, and each is found only by checking every account one by one.

The policy itself deserves the same care. The Cyber Centre’s ransomware playbook warns that if insurance policy documents are poorly protected, attackers can learn the coverage amounts and use them to push up a ransom demand.⁸ We note where your policy documents are stored and who can open them.

How our cyber insurance readiness work runs

The work follows the questionnaire, line by line, and ends before you sign. Each step leaves something written.

What you have in hand

At the end you hold a questionnaire you can sign with confidence and the proof to back it.

• Draft answers to the insurer’s questionnaire, each tied to evidence, for you to complete and sign
• An evidence folder organized by question
• A list of remaining gaps with owners and dates
• A plain-language summary of the security measures in place, for your broker or a client who asks
• The fixes we made, listed with dates, when the scope includes fixing

Where our role stops: the insurer, the broker and you

The insurer decides whether to offer coverage, on what terms and at what premium; the broker advises you on policies; you answer and sign the application. We are neither an insurer nor a broker, we do not sell or compare policies, and we make no promise about approval, premium or coverage.

Our part is technical: making sure that what the form says matches what is configured, and helping you answer each question precisely. Reading the policy wording, its exclusions and its notification rules belongs with your broker or your lawyer. Security work that some applications mention and that we offer only on request, such as penetration testing or round-the-clock monitoring, is named as such in the gap list.