Describe the information flow
Identify the client information the firm receives, where it is stored, who can access it, which vendors process it, and how staff work remotely. Include paper files and portable devices where they remain part of the workflow.
The goal is an accurate operating account, not a technical-security certification.
Collect the documents that matter
Gather client contract security clauses, vendor agreements, incident-response contacts, current policy forms, and a concise description of controls and any prior incidents. Use secure sharing for sensitive material.
Note whether a contract requires a particular cyber limit, notice procedure, or service-provider obligation.
Read cyber terms alongside the operations
Compare the insuring agreements, definitions, exclusions, sublimits, waiting periods, retention, consent and notice conditions, and service-provider provisions. Ask how the proposal distinguishes a security failure, privacy event, funds-transfer issue, business interruption, and professional-services allegation.
A policy can contain multiple coverage parts and conditions; a broad label should not substitute for form-level review.
Keep the next review current
Update the file when the firm adopts a new system, expands remote access, takes on a new vendor, or changes the type of client information handled. Use incident lessons to refine the operating description.
Policy wording, declarations, and endorsements control.
Describe operational exposure without overclaiming technical controls
Cyber insurance for a professional firm should begin with an information inventory: client data received, systems used, remote access, cloud vendors, payment platforms, devices, subcontractors, and the people who can administer them. The inventory should also note data held in paper files or personal devices if those remain part of the service model.
A firm does not need to claim a security certification to give a clear picture. It needs to explain its actual access practices, vendor dependencies, multi-factor authentication where used, backup and incident-response process, and material changes since the previous cyber insurance application.
Cyber insurance and client-contract questions
Compare client security clauses and vendor obligations with the proposed cyber policy’s insuring agreements, exclusions, sublimits, waiting periods, retention, notice requirements, consent provisions, and service-provider terms. Identify whether a contract asks for a limit, a notice timeline, or a particular responsibility that the policy does not plainly address.
A cyber event can also raise professional liability, commercial crime, privacy, or business-interruption questions. Keep those coverage parts distinct in the review. Policy wording, declarations, endorsements, and the facts of an event control.
Inventory information by service and custodian
Choose a representative client project and trace the records it generates: intake documents, contact details, financial or health-related information if applicable, working files, deliverables, archives, and backups. Record which employees, subcontractors, cloud providers, and clients can access each stage. A professional firm may have several client confidentiality regimes, so distinguish contractual duties from laws that actually apply to the particular information and entity.
NIST’s small-business framework is useful for organizing governance, identification, protection, detection, response, and recovery questions. It is not a certification or an insurance policy. Describe the controls the firm actually uses and the owner who can verify them.
Create a dependency and interruption map
List the systems needed to deliver the service, the vendor that hosts each one, how data can be recovered, and whether work can continue manually. Include identity, email, practice management, file storage, billing, and any client-facing platform. Record how long the firm could operate without each system and who would approve an alternate process.
Compare that map with the proposed policy’s first-party interruption, dependent-system, restoration, extra-expense, and waiting-period language where offered. A cyber policy may not address every loss from a client-service failure; professional liability, crime, or contract questions should be reviewed separately.
Prepare a first-hour incident record
Maintain a call tree for technology, operations, privacy or legal, clients where appropriate, critical vendors, and the insurance contact. In an event, preserve the original alert, timeline, affected systems, access logs, vendor notices, workarounds, and incremental costs. Keep a privileged legal analysis, if any, in the channel counsel directs rather than adding it indiscriminately to the operational log.
Check the issued policy’s notice, consent, panel-provider, and documentation instructions without letting insurance administration delay necessary containment. Reconcile lessons and changed controls with the next application. Policy wording, declarations, endorsements, and the actual event facts control.
Compare a service error with a data event
Use two scenarios during proposal review. First, a consultant sends a correct report to the wrong recipient; second, a cloud vendor outage prevents the firm from completing a contracted deliverable. For each, write down the data involved, system owner, client promise, first notice, possible cost categories, and the form clause that needs interpretation. The first could raise privacy and professional-service questions; the second could raise dependent-interruption and contractual questions. Do not assume one cyber insuring agreement resolves all of them.
Compare the policy’s incident definitions, waiting periods, sublimits, retentions, consent conditions, and exclusions with the scenarios. Ask for written clarification where a client contract imposes a duty beyond the form. Keep the comparison in the renewal file, not just in a sales presentation.
Control the accuracy of security answers
Have the technical owner verify whether multi-factor authentication, backups, logging, access reviews, and vendor monitoring actually operate as described in the application. Note where a control applies only to some systems or users. A client security questionnaire may use different definitions from an insurer application; do not copy one answer into the other without checking the underlying fact.
Record the verification date, responsible person, and system evidence, then schedule a review after a new vendor, remote-work change, acquisition, or significant incident. The goal is a current operating description, not a claim of certification or an assumption about policy response.
Decision checklist for your coverage review
Use these questions with the current policy, relevant agreements, and the latest operating records. They help identify what needs a document-level answer before requesting or comparing terms.
- What changed in the organization, its programs, workforce, services, or agreements?
- Which current policy form, declaration, or endorsement should be read with that change in view?
- What definition, exclusion, condition, limit, retention, or policy date needs a documented answer?
- Which agreement, operating record, or final policy document belongs in the review file?
Bring the records into the conversation
Set the declarations, applicable endorsements, governing or service agreements, and the operational record beside this guide. Record the document reviewed, the question raised, the answer received, and anything that remains unresolved. That file helps a board, finance lead, or firm principal revisit the decision when circumstances change.
Yerba Buena Partners can help prepare a commercial insurance submission and compare available terms against the organization’s actual responsibilities. This guide is educational and does not decide a claim or promise coverage; policy wording, declarations, and endorsements control.