A cyber insurance questionnaire is a signed statement of the security controls your dealership actually has, and it can become part of your policy. Take inventory first, answer from that inventory, and explain every no in writing.
Last updated: November 9, 2026
We told a client to say no. It was one of those 100% questions, and our advice was to answer no, use the comments, and say in that answer that nobody can promise it’ll be 100%. They still got coverage.
I want to be careful with that story. It’s one client and one carrier. I can’t promise you’d get the same result, and nobody honest can. But their answer was true the day they signed it, and it’d still be true the day somebody came to check.
We have 2,000-plus dealerships under management and nearly 30 years in this business, and these forms have gotten more complicated. Lockton, the insurance broker, wrote back in 2022 that cyber applications “have become longer and more complex than they were in the past.” If you want to know what carriers ask about, our cyber insurance requirements checklist for dealerships goes through it one control at a time. This post is about the next part, which is how you actually fill the thing out so the renewal goes right and the answers hold up.
What Are You Really Signing on a Cyber Insurance Questionnaire?
“This application shall be deemed attached to and form a part of the Policy should coverage be bound.” That line is near the signature on a Tokio Marine HCC cyber application. That form is written for medical practices, not dealerships, but the AXIS ransomware supplement says much the same thing and adds that any policy “will be issued in reliance upon these representations.”
A cyber insurance questionnaire, also called a cyber insurance application or supplemental application, is the form a carrier uses to decide whether to cover your dealership and on what terms. It asks which security controls you run, someone with authority signs it, and the answers can become part of the contract.
Read it that way and the whole job changes. These are specific statements, and somebody relied on them when they agreed to insure you. That signature does real work.
Why Do Dealers Get These Answers Wrong?
The bigger problem I see is dealers answering these questionnaires without knowing what they have or don’t have. And nobody wants to write no on a form that decides whether the store gets insured.
And the questions are specific. That Tokio Marine HCC form asks, “Is EDR deployed and monitored on 100% of workstations and servers?” (EDR is endpoint detection and response.) AXIS wants a number, “what % of the Applicant’s endpoints is EDR deployed on?”, and asks again for servers. So what does 100% actually mean at a dealership? It means the spare laptop, the PC that just came back from repair, and the new hire’s machine in the BDC, on the day you sign. All of them. Monitored is a separate promise, too, since a tool that’s installed and badly set up is a dealership EDR issue of its own.
MFA gets the same treatment. The Tokio Marine HCC form puts this above its MFA questions: “By selecting ‘Yes’ to the Multi-Factor Authentication (MFA) question, you represent that MFA is implemented and enforced prior to the inception of the proposed policy and will remain continuously implemented and enforced for the duration of the policy period.” That’s a yes that keeps running for the whole policy. Read it twice.
Carriers write these forms in their own interest. The Tokio Marine HCC form says the signed application lets the underwriter decide whether to bind coverage and “determine the terms of such insurance.” Fair enough. It does mean a guess can cost you plenty.
What Happens When an Answer Turns Out to Be Wrong?
Insurance Journal called Travelers v. International Control Services possibly “one of the first court filings of its kind.” On July 6, 2022, Travelers asked a federal court in Illinois to rescind a cyber policy (No. 22-cv-2145, C.D. Ill.), alleging that the application, signed by the company’s CEO and “a person responsible for its network and information security,” said it used MFA for administrative or privileged access. Travelers said it learned during an investigation after a May ransomware attack that the company “only used MFA to protect its firewall, and did not use MFA to protect any other digital assets.”
It never went to trial. On August 26, 2022, the two sides filed a joint stipulation asking the court to declare the policy “null and void, from its inception.” Lockton reported that the court entered judgment for Travelers, and as Lockton puts it, a rescinded policy “ceases to exist for all purposes.” Lockton’s takeaway was that “organizations should assume that incorrect answers in applications will have significant and unfortunate consequences.”
Look at the timing. The answer got checked after the attack. That’s about the worst day to find out.
And it came down to what the application said about MFA.
How Should You Prepare Before You Answer a Single Question?
Take inventory first and answer second. Build a current list of the devices and accounts at each rooftop, plus every way into the network from outside, then check it against what your security tools report. Give each question an owner who can show proof, and let the officer sign only after that.
- Pull last year’s application. You need to know what you already told them.
- Count every device, rooftop by rooftop. That means shop-floor machines and the spare in the closet, not just what’s on the sales floor.
- Match that count against your EDR console. Say the list shows 212 machines and the console shows 197. Those 15 are your real answer. Now go find them.
- Circle the absolute words on the form: all, 100%, enforced, continuously.
- Who owns that? Put one name beside each question, along with the report that backs it up.
- Write your comments while the evidence is still open on the table in front of you.
- Have the signer read it all. Every line. The Tokio Marine HCC form says, “Must be signed by an officer of the company.”
- Watch the calendar until the policy starts. AXIS wants material changes to your answers reported “immediately in writing.”
Vendors belong in that count as well, because AXIS asks about MFA for “Third Party/Vendor Access” by name, and our dealership IT vendor inventory worksheet will get that list started. And you may already owe yourself this inventory. If you’re a covered dealership, the FTC Safeguards Rule, at 16 CFR 314.4(c)(2), tells you to “Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes …” Do it once, and it can serve both the rule and the renewal, which is where our FTC Safeguards Rule checklist picks up.
Inventory first. Everything else on this list gets easier after that.
What Evidence Should Back Each Answer?
Here’s real wording from those two published forms, so yours will read differently, along with the word I’d slow down on and the proof I’d want in the folder.
| What the form says | Slow down on | What to have on file |
|---|---|---|
| “Is EDR deployed and monitored on 100% of workstations and servers?” (Tokio Marine HCC) | “100%” and “monitored” | A dated device list matched to the EDR console, and the name of whoever watches the alerts |
| “what % of the Applicant’s endpoints is EDR deployed on?” (AXIS) | The number itself | The math, with the date you ran it |
| “Multi Factor Authentication for all Microsoft 365 users” (AXIS) | “all” | A Microsoft 365 admin report showing enforcement, not just who has registered an MFA method |
| “Is MFA implemented and enforced to secure all remote access to your network for all employees and third parties …” (Tokio Marine HCC) | “third parties” | A list of every remote way in, including each vendor’s (the form names VPNs, RDP, RDWeb and RMM tools) |
| “Please identify the number of domain and service accounts the Applicant has in the Domain Admin Group” (AXIS) | The count | An export of that group, dated, with an owner beside each account |
If MFA is the line that’s giving you trouble, we’ve written separately about the right way to do MFA. The test doesn’t change. If you can’t pull the report, you don’t have the answer yet.
How Do You Word an Honest No?
The forms leave room. Tokio Marine HCC’s comments box says, “Use this space to explain any ‘No’ answers in the above sections,” and on the EDR question it asks you to “outline which assets do not have EDR, and whether any mitigating safeguards are in place for such assets.” AXIS has an additional commentary box too.
So use it. Say what’s covered, what isn’t, as of what date, and what you’re doing about the rest. Here’s the shape I’d start from, and only if every word of it is true at your store:
No. As of [date], EDR is deployed and monitored on all workstations and servers in our current device inventory except the [number] listed below, for the reasons given. Devices are added and replaced during the year, so we can’t promise 100% at every moment. We compare the inventory against the EDR console every [interval].
“If we write no, won’t they just decline us?” They might. I won’t pretend otherwise. We’ve had clients come to us in the past because they were denied cyber liability insurance because they didn’t have things they needed. That’s a real problem. But you can see it and work on it, with a specific control to go fix. A yes that falls apart after a ransomware attack gives you nothing to work with, at the worst time you could pick.
We aren’t an insurance agency. I’m not your lawyer either. Run the wording past your broker, and if a question really worries you, get a coverage attorney to read it. For what it’s worth, we’ve written before about getting more favorable cyber insurance terms, but I won’t tell you a no is free, or that a premium will drop.
I’d still write the no.
Things Dealers Ask About the Questionnaire
Who at the store should actually fill this out?
Can the carrier really check what we wrote?
Will a no raise our premium?
We turned on MFA after we sent the form in. Do we need to say anything?
We think last year’s answer was wrong. Now what?
Know What You Have, Then Sign
Bias disclosed. We sell dealership cybersecurity services, including managed detection and response, so I have an interest here. On a questionnaire, though, our part is advisory. Know what you need, know what you don’t have, fill it out properly. We can sit with you on that, and we’ve already seen this exact problem.
If your renewal is coming up, start with our complimentary IT and cybersecurity assessment. It reviews your technology setup, whether tools like EDR and firewalls are configured correctly, and where you stand against the FTC Safeguards Rule, and you get the findings in writing. That’s your raw material.
An honest no is something you can defend. A hopeful yes is just a bet with your signature on it.