Search
Get A Demo
Get Started
    Get A Demo
    Get Started
      How Blumira Helps With

      The CISO's Checklist for Cyber Insurance Requirements

      There are many types of insurance policies that ask questions about cybersecurity. These questions can be tough to answer if you have overlapping products and services. Blumira has captured many cyber insurance application questions so we can provide suggested answers for Blumira customers and partners. Be sure to update your answers based on the Blumira configuration you’re using and the state of your network security.

      Try Blumira for 30 days

      Cyber Insurance Application Tips

      Remember, when filling out an insurance application:

      Data Insights
      Be honest

      Your answers need to be technically accurate for the point in time that the application is being filled out.
      Smart Automation
      Provide context

      Try to stay away from one-word answers and add any information  that could be helpful to the insurance carrier. Explain what you’re doing - or not doing - and why.
      Efficient
      Possible Risk Information

      Supply additional information for a complete picture of possible risk. For example, if there are two executives that refuse to turn on MFA for their email, disclose that on the application. That way, should they get phished in the future and it leads to a breach, the insurance company was aware of that risk when they agreed to bind your policy.

      Insurance Application Reference Questions and Suggested Responses

      Click on the top to see the full question and suggested response.

      • Security Information and Event Management System (SIEM)?

        Does the applicant use a Security Information and Event Management system (SIEM)?

        Yes. We use Blumira as our SIEM, which collects and analyzes log data for our organization. Blumira provides us with detections across data sent to them and has their own internal detection engineering team that tracks and stays up to date on all new vulnerabilities and methods of detection. If threats are identified, Blumira sends prioritized threat findings/alerts to our helpdesk with case management and playbooks built into each detected event so we always have a guided response. Additionally, Blumira provides the ability to generate reports, automated and ad hoc, for our compliance and internal visibility needs. All data sent to Blumira is kept for 1 year and Blumira’s Security Operations (SecOps) team is available 24/7 for urgent incident response support.

      • Security Operations Center (SOC)

        Please provide details on whether you have a Security Operations Center (SOC) that is responsible for event monitoring, detection, and incident response. Please include details on the hours of operation and whether this is an internal function or outsourced to a third party.

        SOC Definition: Security Operations Center (SOC) is an information security team responsible for monitoring and analyzing an organization’s security posture on an ongoing basis. The SOC team’s goal is to detect, analyze and respond to cybersecurity incidents using a combination of technology solutions and a strong set of processes. SOCs can be internal and run by the organization themselves or outsourced to a third party.

        Suggested Response: Blumira provides us with automated security operations via their SIEM platform as well as a 24×7 Security Operations team for event monitoring and detection as well as guided incident response. The Blumira platform analyzes the data it receives and detects threats, operational risks, and suspicious behavior for our organization. The platform also provides remediation process guidance to help us respond to incidents. The Blumira Customer Success team reviews our security posture with us on an ongoing basis and the Blumira Security Operations (SecOps) team is available 24/7 for urgent incident response support.

      • Advanced Threat Protection

        Does the applicant have Advanced Threat Protection settings enabled on their network?

        We have Advanced Threat Protection enabled via <insert EDR name> and collect additional EDR-based telemetry via Blumira Agent. This allows us to identify threat behaviors ahead of proper AV signatures and track any potentially negative behaviors by internal IT teams within the organization. We also have our firewall logs sent to Blumira for event monitoring and advanced threat protection.

        All data sent to Blumira is kept for 1 year and the Blumira Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

        Note – If you use Blumira’s Dynamic Blocklist feature and have it configured in your firewalls, this would be a good place to mention it for the automated blocking of bad IPs based on numerous threat intelligence feeds.

      • Firewall / IPS Configurations with Log Retention?

        Do you have inbound and outbound firewall / IPS configurations with log retention?

        Yes, we send our firewall logs with IPS enabled to Blumira for both directions as well as internally-routed segments that pass through their respective firewalls. Blumira stores these logs for 1 year and performs ongoing threat feed and data analysis on these logs to ensure that threats missed by the IPS are identified. Additionally, we use Blumira to look for large transfers in and out of the environment across the firewall. If necessary, Blumira’s Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      Does the applicant use a Security Information and Event Management system (SIEM)?

      Yes. We use Blumira as our SIEM, which collects and analyzes log data for our organization. Blumira provides us with detections across data sent to them and has their own internal detection engineering team that tracks and stays up to date on all new vulnerabilities and methods of detection. If threats are identified, Blumira sends prioritized threat findings/alerts to our helpdesk with case management and playbooks built into each detected event so we always have a guided response. Additionally, Blumira provides the ability to generate reports, automated and ad hoc, for our compliance and internal visibility needs. All data sent to Blumira is kept for 1 year and Blumira’s Security Operations (SecOps) team is available 24/7 for urgent incident response support.

      Please provide details on whether you have a Security Operations Center (SOC) that is responsible for event monitoring, detection, and incident response. Please include details on the hours of operation and whether this is an internal function or outsourced to a third party.

      SOC Definition: Security Operations Center (SOC) is an information security team responsible for monitoring and analyzing an organization’s security posture on an ongoing basis. The SOC team’s goal is to detect, analyze and respond to cybersecurity incidents using a combination of technology solutions and a strong set of processes. SOCs can be internal and run by the organization themselves or outsourced to a third party.

      Suggested Response: Blumira provides us with automated security operations via their SIEM platform as well as a 24×7 Security Operations team for event monitoring and detection as well as guided incident response. The Blumira platform analyzes the data it receives and detects threats, operational risks, and suspicious behavior for our organization. The platform also provides remediation process guidance to help us respond to incidents. The Blumira Customer Success team reviews our security posture with us on an ongoing basis and the Blumira Security Operations (SecOps) team is available 24/7 for urgent incident response support.

      Does the applicant have Advanced Threat Protection settings enabled on their network?

      We have Advanced Threat Protection enabled via <insert EDR name> and collect additional EDR-based telemetry via Blumira Agent. This allows us to identify threat behaviors ahead of proper AV signatures and track any potentially negative behaviors by internal IT teams within the organization. We also have our firewall logs sent to Blumira for event monitoring and advanced threat protection.

      All data sent to Blumira is kept for 1 year and the Blumira Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      Note – If you use Blumira’s Dynamic Blocklist feature and have it configured in your firewalls, this would be a good place to mention it for the automated blocking of bad IPs based on numerous threat intelligence feeds.

      Do you have inbound and outbound firewall / IPS configurations with log retention?

      Yes, we send our firewall logs with IPS enabled to Blumira for both directions as well as internally-routed segments that pass through their respective firewalls. Blumira stores these logs for 1 year and performs ongoing threat feed and data analysis on these logs to ensure that threats missed by the IPS are identified. Additionally, we use Blumira to look for large transfers in and out of the environment across the firewall. If necessary, Blumira’s Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      • 24/7 Network Monitoring

        Do you use a network monitoring solution to alert your organization to suspicious activity or malicious behavior on your network and is it monitored 24/7?

        We use Blumira for all network monitoring to determine if suspicious activity or malicious behavior occurs, and Blumira provides 24×7 support for their Security Operations team to our internal IT team. If a high priority alert is triggered, we are called, texted, and emailed so we can follow remediation guidance provided by Blumira. If additional support is required, we can speak to the Blumira Security Operations team within 1 hour. All data sent to Blumira is kept for 1 year.

      • Protect Privileged User Accounts

        Please provide details on how you protect privileged user accounts (e.g. using privileged access management solutions, restricting privileged user accounts to specific devices, enhanced monitoring of accounts for anomalous usage, multi-factor authentication enabled for remote access etc).

        Blumira monitors the modification of all IAM within our environments (e.g., on-prem Active Directory, firewall management, Microsoft 365, and Azure). Blumira alerts to the creation, modification, and potential attacks against these accounts such as password spraying or brute forcing. Blumira additionally allows us to enable louder alerts such as account lockouts and account reset patterns which our helpdesk uses to support our employees as needed. We also use Blumira to detect plaintext password files on hosts to ensure that user account passwords are not lost on the host.

        All data sent to Blumira is kept for 1 year and Blumira’s Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      • Additional Steps to Detect and Prevent Ransomware Attacks

        Please describe any additional steps your organization takes to detect and prevent ransomware attacks (e.g. segmentation of your network, additional software tools, external security services, etc.)

        Blumira SIEM is in use to collect logs from all production systems, including Windows servers and workstations with Sysmon enabled, WAN firewalls, cloud-hosted Microsoft 365 email, and all other Microsoft 365 apps, and our MFA provider. This combined with their threat feed evaluation allows for us to be aware if a known-bad IP is attempting to attack us and block it by default. If an attacker is able to land within the environment, we use the Blumira platform to analyze our logs and detect all potential methods of early access. These alerts are sent to our MSP’s technical/security staff who triage and respond to alerts based on their priority level. All data sent to Blumira is kept for 1 year and is available for investigation and reporting. The Blumira Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      Do you use a network monitoring solution to alert your organization to suspicious activity or malicious behavior on your network and is it monitored 24/7?

      We use Blumira for all network monitoring to determine if suspicious activity or malicious behavior occurs, and Blumira provides 24×7 support for their Security Operations team to our internal IT team. If a high priority alert is triggered, we are called, texted, and emailed so we can follow remediation guidance provided by Blumira. If additional support is required, we can speak to the Blumira Security Operations team within 1 hour. All data sent to Blumira is kept for 1 year.

      Please provide details on how you protect privileged user accounts (e.g. using privileged access management solutions, restricting privileged user accounts to specific devices, enhanced monitoring of accounts for anomalous usage, multi-factor authentication enabled for remote access etc).

      Blumira monitors the modification of all IAM within our environments (e.g., on-prem Active Directory, firewall management, Microsoft 365, and Azure). Blumira alerts to the creation, modification, and potential attacks against these accounts such as password spraying or brute forcing. Blumira additionally allows us to enable louder alerts such as account lockouts and account reset patterns which our helpdesk uses to support our employees as needed. We also use Blumira to detect plaintext password files on hosts to ensure that user account passwords are not lost on the host.

      All data sent to Blumira is kept for 1 year and Blumira’s Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      Please describe any additional steps your organization takes to detect and prevent ransomware attacks (e.g. segmentation of your network, additional software tools, external security services, etc.)

      Blumira SIEM is in use to collect logs from all production systems, including Windows servers and workstations with Sysmon enabled, WAN firewalls, cloud-hosted Microsoft 365 email, and all other Microsoft 365 apps, and our MFA provider. This combined with their threat feed evaluation allows for us to be aware if a known-bad IP is attempting to attack us and block it by default. If an attacker is able to land within the environment, we use the Blumira platform to analyze our logs and detect all potential methods of early access. These alerts are sent to our MSP’s technical/security staff who triage and respond to alerts based on their priority level. All data sent to Blumira is kept for 1 year and is available for investigation and reporting. The Blumira Security Operations (SecOps) team is available 24/7 for urgent guided incident response support.

      • Endpoint Detection and Response (EDR) and Next-Generation Antivirus (NGAV)

        Does the applicant use Endpoint Detection and Response (EDR) or a Next-Generation Antivirus (NGAV) software (e.g., CrowdStrike, Cylance, Carbon Black) to secure all system endpoints?

        We use the Blumira EDR agent. which provides endpoint detection and response for Windows endpoints. The agent sends logs to the Blumira platform for near real-time detection and the Blumira platform provides playbooks for guided response. The agent also gives us the ability to isolate hosts in order to contain a threat detected on an endpoint. Detections are created and managed by the Blumira SecOps team who are also available 24/7 to help us with critical incidents should the need arise.

      • EDR Monitoring and Management

        Please provide an overview of how your EDR product is monitored and managed (e.g. Internal IT team or outsourced to a third party).

        Using the Blumira EDR agent, our Windows endpoint logs are sent to the Blumira detection and response platform which monitors and analyzes logs for suspicious or threat activity.

        The platform notifies us when it detects anomalies and we follow playbook instructions on how to respond, including isolating the host if recommended to contain a threat on an endpoint, cutting off access to the rest of the network. Blumira incident detection engineers proactively manage detections, updating them to keep us protected from new vulnerabilities and exploits.

        The Blumira security operations (SecOps) team provides 24/7 support for all critical priority issues and helps our IT provider with guided response, security advice, and investigation. If needed, they will work with an incident response team to help resolve any identified issues.

      • 24/7 Staffed and Managed Endpoint Detection and Response (EDR)

        Does the applicant use a 24/7 staffed and managed Endpoint Detection and Response (EDR) for all endpoints? (If yes to EDR, please list provider in the comments).

        We use the Blumira EDR agent paired with the Blumira automated detection and response platform to provide coverage for all of our Windows endpoints. The Blumira SecOps team provides 24/7 support and guided response for critical priority issues. Blumira incident detection engineers manage the platform’s detection rules, keeping them up to date to identify the latest vulnerabilities and exploits. Our team is notified of any endpoint threats, and we take action based on provided playbooks to investigate and respond promptly, including isolating the host if recommended to contain a threat on an endpoint, cutting off access to the rest of the network.

      • Endpoint Application Isolation and Containment Technology

        Do you use endpoint application isolation and containment technology on all endpoints? If yes, name your provider

        We have the Blumira endpoint agent on all Windows devices. It provides endpoint isolation and containment technology, enabling us to isolate a host and cut off its network access (other than to Blumira, which continues collecting log data from the device for incident response) when the Blumira platform detects an endpoint threat.

      Does the applicant use Endpoint Detection and Response (EDR) or a Next-Generation Antivirus (NGAV) software (e.g., CrowdStrike, Cylance, Carbon Black) to secure all system endpoints?

      We use the Blumira EDR agent. which provides endpoint detection and response for Windows endpoints. The agent sends logs to the Blumira platform for near real-time detection and the Blumira platform provides playbooks for guided response. The agent also gives us the ability to isolate hosts in order to contain a threat detected on an endpoint. Detections are created and managed by the Blumira SecOps team who are also available 24/7 to help us with critical incidents should the need arise.

      Please provide an overview of how your EDR product is monitored and managed (e.g. Internal IT team or outsourced to a third party).

      Using the Blumira EDR agent, our Windows endpoint logs are sent to the Blumira detection and response platform which monitors and analyzes logs for suspicious or threat activity.

      The platform notifies us when it detects anomalies and we follow playbook instructions on how to respond, including isolating the host if recommended to contain a threat on an endpoint, cutting off access to the rest of the network. Blumira incident detection engineers proactively manage detections, updating them to keep us protected from new vulnerabilities and exploits.

      The Blumira security operations (SecOps) team provides 24/7 support for all critical priority issues and helps our IT provider with guided response, security advice, and investigation. If needed, they will work with an incident response team to help resolve any identified issues.

      Does the applicant use a 24/7 staffed and managed Endpoint Detection and Response (EDR) for all endpoints? (If yes to EDR, please list provider in the comments).

      We use the Blumira EDR agent paired with the Blumira automated detection and response platform to provide coverage for all of our Windows endpoints. The Blumira SecOps team provides 24/7 support and guided response for critical priority issues. Blumira incident detection engineers manage the platform’s detection rules, keeping them up to date to identify the latest vulnerabilities and exploits. Our team is notified of any endpoint threats, and we take action based on provided playbooks to investigate and respond promptly, including isolating the host if recommended to contain a threat on an endpoint, cutting off access to the rest of the network.

      Do you use endpoint application isolation and containment technology on all endpoints? If yes, name your provider

      We have the Blumira endpoint agent on all Windows devices. It provides endpoint isolation and containment technology, enabling us to isolate a host and cut off its network access (other than to Blumira, which continues collecting log data from the device for incident response) when the Blumira platform detects an endpoint threat.

      FS_TBG_Logo_Dark_White_BGSPECIAL OFFER FROM OUR PARTNER
      20% Off Admin Costs
      for Blumira Clients

      Founder Shield is a risk management partner for high-growth companies across emerging markets, striving to create the most seamless, intuitive, and responsive insurance-purchasing experience powered by proprietary technology and insurance products. 

      We craft insurance solutions as unique as your vision. Forget a transactional approach. Our risk advisors, industry veterans with you every step of the way, understand the digital age's specific challenges for your business. We leverage technology for a smooth experience and provide unwavering support. Focus on what matters most — protecting the possible.

      Learn More About Founder Shield ->

      Frequently Asked Questions

      What do cyber insurance underwriters ask about security monitoring?

      Underwriters typically ask whether your organization has a SIEM or centralized log management system, whether you monitor your environment 24/7 or only during business hours, how long you retain security logs, whether you have automated alerting for security events, and whether detected threats are investigated and documented. The trend in underwriting has shifted from checkbox questions ("Do you have a SIEM? Yes/No") to evidence-based evaluation ("Show us your monitoring dashboard, show us your last 3 incident response reports, show us your log retention policy"). Organizations that can demonstrate active monitoring with evidence tend to qualify for better terms than those that simply check the box.

      How do I document my security posture for a cyber insurance application?

      Insurance applications increasingly require supporting evidence beyond yes/no answers. Prepare documentation of your security tools and their coverage (what systems are monitored, what is not), your log retention policy with evidence that it is being followed, sample alert reports showing your team investigated and responded to detected threats, your written incident response plan, evidence of regular vulnerability scanning or penetration testing, and a summary of your access control and MFA implementation. A SIEM that generates compliance-ready reports makes this documentation process significantly easier. Blumira provides exportable alert histories, log retention verification, and detection coverage summaries that map directly to common underwriting questions.

      What are the most common reasons cyber insurance claims are denied?

      Claims are most commonly denied or reduced when the insured organization misrepresented its security posture on the application (for example, claiming 24/7 monitoring when no monitoring system was in place), when the organization failed to maintain the security controls it attested to during underwriting, when the breach resulted from a known vulnerability that the organization failed to patch within a reasonable timeframe, or when the insured did not follow its own incident response procedures. Having audit logs that prove your controls were active at the time of the incident is critical. Without a SIEM or centralized logging, you may not be able to demonstrate that your security controls were operational when the breach occurred.

      What is the difference between first-party and third-party cyber insurance coverage?

      First-party coverage pays for your organization's direct losses from a cyber incident. This includes incident response and forensic investigation costs, business interruption losses, data restoration expenses, ransom payments (where legal), notification costs for affected individuals, and credit monitoring services. Third-party coverage protects against claims from others affected by the incident. This includes lawsuits from customers whose data was exposed, regulatory fines and penalties, payment card industry (PCI) fines, and legal defense costs. Most policies include both, but coverage limits and sub-limits vary significantly. Review your policy's definitions of "security failure" and "privacy event" carefully, as these determine what triggers coverage.

      How does Blumira help answer cyber insurance application questions?

      Blumira provides direct answers to the most common underwriting questions. For "Do you have a SIEM?", Blumira is a cloud SIEM with centralized log collection. For "Do you monitor 24/7?", Blumira monitors continuously with automated detection rules active around the clock. For "How long do you retain logs?", Blumira retains all log data for one year. For "Do you have automated alerting?", Blumira sends real-time alerts with response playbooks for every detected threat. For "Can you demonstrate incident response?", Blumira provides documented alert histories, investigation timelines, and response actions. Founder Shield, a cyber insurance provider, offers a 20% discount on administration costs for organizations using Blumira.

      What security baseline should I have before applying for cyber insurance?

      Most carriers expect seven baseline controls before they will issue a policy: multi-factor authentication on all remote access and privileged accounts, endpoint detection and response (EDR) on all devices, offline or immutable backups with tested restoration procedures, a written incident response plan, employee security awareness training, a patch management process with documented timelines, and access controls with least-privilege policies. Beyond these baselines, underwriters increasingly ask about centralized log management and monitoring (SIEM), log retention (typically one year minimum), and penetration testing (often required for policies above $1 million in coverage). Having these controls documented and demonstrable before you apply will put you in a stronger negotiating position on both coverage terms and premium pricing.

      How often do cyber insurance requirements change at renewal?

      Expect underwriting requirements to tighten at every renewal cycle. The cyber insurance market has been hardening since 2020, with carriers adding new requirements after each cycle of major claims. Common changes at renewal include new questions about specific threat categories (ransomware preparedness was added broadly in 2021-2022, supply chain risk questions increased in 2023-2024), higher expectations for evidence (moving from attestation to proof), increased minimum requirements for coverage above certain thresholds, and adjusted premiums based on the insured's claims history and the broader market's loss ratios. Organizations that proactively implement monitoring, logging, and incident response before their renewal are better positioned to maintain favorable terms. Waiting until the renewal questionnaire arrives to scramble for new controls often results in higher premiums or coverage gaps.

      Experience Blumira Today

      Tired of fragmented security tools and alert fatigue? Blumira centralizes your security operations, offering deep insights and actionable intelligence to identify and remediate threats before they cause damage. Discover the power of proactive defense.

      Get Your Trial