Answer a few questions to estimate insurance need, a coverage range, and the security controls commonly expected by cyber insurance carriers.
✅ Standalone•Client-friendly
Client Inputs
PII (customer/employee personal data)
Names, addresses, DOB, SSNs, etc.
PHI / healthcare data
HIPAA and similar requirements
PCI / payment card data
Cardholder data environment
Regulated (GLBA, NYDFS, FERPA, etc.)
Industry-specific compliance
MFA on email/VPN/admin
Often required by carriers
EDR / AV managed
Detection + response capability
Email security (filtering, DMARC, etc.)
Reduces phishing/business email compromise
Encrypted backups with testing
Critical for ransomware recovery
Vulnerability scanning
Regular scanning + remediation
Patch management
Timely OS/app updates
Security awareness training
Usually expected annually/quarterly
Incident response plan
Documented roles + process
Disaster recovery plan
Recovery steps + RTO/RPO targets
This tool provides a directional estimate and does not replace legal/insurance advice.
Recommendation
Complete the form →
Insurance need
—
Suggested coverage range
—
Primary drivers
—
Controls to improve insurability (missing)
—
Estimated risk tier
—
Tip: if the client is unsure, treat unknowns as risk-increasing (insurers often do).
Why cyber insurers require security services
Most cyber insurance carriers condition coverage, pricing, and even claims outcomes on a baseline level of cybersecurity controls.
If required controls are missing, insurers may raise premiums, exclude coverage for certain events, delay underwriting, or deny/limit claims tied to negligent controls.
The items below map common services to typical cyber policy expectations and the kinds of evidence insurers ask for.