The cyber insurance questionnaire is not a formality. Your answers become part of the contract. If you declare a security measure that is not really in place, the insurer can reduce or refuse your claim on the day you need it most. The fix: check every answer with your IT team and keep the proof.
The cyber insurance market in 2026
- Only 22% of Canadian SMBs have cyber insurance, and 12% a stand-alone policy (Angus Reid survey for the Insurance Bureau of Canada, 2025).
- 72% of SMB owners worry that artificial intelligence makes cyber risk harder to manage.
- Good news: prices are falling. According to Marsh, cyber insurance rates in Canada fell 6% in the second quarter of 2026. Companies with strong controls get better terms.
What insurers check, and the proof to keep
| Measure requested | Typical question | Proof to keep |
|---|---|---|
| Multi-factor authentication | Is it on for email, remote access and admin accounts? | Access policy report and list of exceptions |
| Endpoint protection (EDR) | Is it installed on 100% of computers and servers? | Console report, matched against your inventory |
| Backups | Are they offline or immutable, and tested? | Configuration and dated restore-test log |
| Updates | Are critical patches applied quickly? | Monthly compliance report |
| End-of-life systems | Do you still have Windows 10 or unsupported servers? | Inventory and replacement plan |
| Privileged accounts | Do administrators use separate accounts? | List of admin accounts and quarterly review |
| Filtering, spoofing protection (SPF, DKIM, DMARC)? | Domain and filtering configuration | |
| Training | Are employees trained and tested against phishing? | Completion rates and simulation results |
| Payments | Are banking detail changes verified by phone? | Written dual-authorization procedure |
| Incident response plan | Do you have an incident plan? | Dated plan, contacts and annual exercise |
| Vendor access | Do your IT providers use multi-factor authentication? | List of remote access tools and contracts |
| Security testing | Do you run an annual audit or penetration test? | Latest report and proof of remediation |
What happens if you answer wrong
In the United States, International Control Services declared that it used multi-factor authentication. In reality, it only protected its firewall. After a ransomware attack in 2022, the insurer Travelers sought to cancel the policy, and the company agreed. It was left without coverage.
In Québec, the Civil Code provides that a misstatement made in good faith reduces the payout in proportion to the premium that should have been paid; if the insurer would never have accepted the risk, or in case of bad faith, it may pay nothing.
In Ontario, the Court of Appeal confirmed in 2025 (Kashin v. G.E.S. Construction) that an insurer could void a policy because the business misdescribed its operations on its application. Across Canada, insurers’ forms also exclude claims linked to undisclosed facts.
The threats driving the requirements
- Ransomware. According to the Canadian Centre for Cyber Security, ransomware incidents in Canada have grown about 26% a year since 2021.
- Email fraud. Business email compromise and funds transfer fraud made up 58% of incidents reported to insurer Coalition in 2025.
- AI-powered phishing. Fake emails and fake voices are more convincing than ever. The Canadian Anti-Fraud Centre recorded more than $704 million in reported losses in 2025.
- Privacy laws. In Ontario and elsewhere in Canada, the federal law (PIPEDA) has required since 2018 that any breach posing a real risk of significant harm be reported to the Privacy Commissioner of Canada, that affected people be notified, and that a record be kept for 24 months. In Québec, Law 25 adds its own rules: the CAI received 514 incident reports in 2024-2025.
Before you sign your questionnaire
- Have every answer checked by your IT team or provider, with proof.
- Only check “yes” if the measure is in place everywhere, not just partly.
- Keep a dated copy of the signed questionnaire.
- Gather the proof from the table above in one folder.
- Tell your insurer about any major change during the year.
How UpSystems helps you answer “yes” for real
- Security audit ($300 to $2,500, 1 to 2 days). We go through your questionnaire with you, check every measure, and you leave with the proof and a plan to close the gaps.
- Penetration test (from $4,000). Several insurers ask for an annual test. Our report, in French or English, documents what was tested and fixed.
- Managed services (from $25 per user per month). Multi-factor authentication, updates, advanced endpoint protection with tools such as SentinelOne and Bitdefender, and 24/7 monitoring and anti-phishing training as options.
- A measured team. A 4.6 out of 5 score after every ticket, a 30-day satisfaction guarantee and more than 75 companies supported.
Renewal coming up? Book a 30-minute call and bring your questionnaire. See also our security audit.
Frequently asked questions
Is cyber insurance mandatory for an SMB?
No, but some clients and prime contractors require it by contract. The Canadian Centre for Cyber Security recommends buying it, or documenting why you do not.
Can an insurer refuse a cyber claim?
Yes, especially if a questionnaire answer was inaccurate. In Québec, the payout can be reduced, or refused in case of bad faith. In Ontario, courts have upheld voiding a policy over a misrepresentation in the application.
Is multi-factor authentication required?
It is the most common questionnaire question: for email, remote access and admin accounts. Without it, expect a higher premium or a refusal.
What if a measure is not in place yet?
Answer honestly and attach your plan with a date. A declared gap costs less than a refused claim.