Answering a Cyber Insurance Questionnaire for Crypto Firms

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. A cyber insurance application asks about MFA, EDR, backups, phishing training, incident response and vendors. Say yes only to controls enforced for the whole term, disclose your crypto and key setup, and keep dated evidence behind every answer.

Watch: Answering a Cyber Insurance Questionnaire for Crypto Firms 1:41

Video transcript

Cyber insurance applications now read like control audits. Say yes only to controls you enforce all term, disclose your crypto setup, and keep dated evidence behind every answer.

An officer signs the answers, and once cover is bound, they form part of the policy.

Expect questions on MFA, EDR, backups, payment checks and incident response. Behind each, keep evidence, like an identity provider export or a dated, timed restore test.

Crypto adds questions on keys. Prepare answers on key custody, signing controls, hot wallet limits, admin keys and recovery. Also ask your broker in writing which policy covers a drained hot wallet.

The UK's National Cyber Security Centre warns about false answers. In 2022, Travelers and ICS jointly asked a court to void a cyber policy after a dispute over MFA.

Answer for the whole term. Match the scope, including third parties. Count every system. Where there is a gap, say no and explain. Report changes in writing.

A precise no is safer than an optimistic yes. Name the scope, the exceptions and the evidence.

Guardian is not an insurer or a broker. We help you prove the controls, with a pentest and retest, an onchain signer inventory, a timed restore, and review of every multisig transaction.

Read the article for template answers, or talk to Guardian about backing every answer with evidence at guardian.security.

Cyber insurance applications now read like control audits. An officer signs the answers, and if cover is bound they become part of the policy.

Take Tokio Marine HCC's TechGuard cyber application (form TEO-NBA, June 2026). It says the application "shall be deemed attached to and form a part of the Policy".

The same form asks whether you work with "cryptocurrency, tokens, NFTs, wallets or exchanges". Here is what insurers ask, what crypto adds, and how to answer without putting cover at risk.

What the Application Asks

The questions below come from the TechGuard form and from Indiana's state cyber insurance toolkit, which groups common underwriting questions into 18 categories.

Control	What insurers ask	Evidence to keep
MFA	All remote access, staff and third parties; webmail	Identity provider policy export and exception list
EDR	A named tool on 100% of workstations and servers	Coverage report checked against the asset inventory
Backups	Immutable, kept apart, behind MFA; frequency and restore time	Backup settings and a dated, timed restore test
Access	MFA on privileged accounts; account lockout; least privilege	Admin account list and last access review
Phishing	Training with phishing simulations for all employees	Completion and simulation results
Payments	Callback checks before paying new payees or changing bank details	Written procedure and a sample log
Patching	Critical and high patches within 30 days	Patch reports
Incident response	A written incident response plan	The plan, role holders and a dated tabletop
Vendors	Your three most critical vendors	Vendor register with review dates
Loss history	Breaches, extortion and outages over 4 hours in 3 years	Incident log

You also list every domain you run. By signing, you consent to the insurer's "non-intrusive scans" of your internet-facing systems.

So the insurer can check part of your answers itself.

What Crypto Adds

First, do not assume a cyber policy pays for stolen tokens. Ask your broker, in writing, which policy responds to a drained hot wallet.

Our guide to crypto insurance for institutions maps which policy covers what. This section covers the questions.

Expect them to turn to keys. Aon's capacity paper says clients should be able to explain:

The minimum number of people needed to create a fraudulent transaction.
How it could happen, and what systems prevent it.

Prepare answers on:

Key custody: where each key lives (HSM, MPC, multisig or hardware wallet) and who holds it.
Signing controls: thresholds, transaction checks before signing, allowlists and timelocks.
Hot wallet limits: the cap on hot balances and who approves refills.
Admin keys: who can upgrade, pause or mint your contracts.
Recovery: key ceremony records, backups and a tested recovery.

Back each one with records: a signer inventory read from the chain, ceremony logs and the hot wallet policy.

Answer the crypto question truthfully. The form also tells you to complete "all required supplemental forms/applications".

Mistakes That Put Cover at Risk

The UK's National Cyber Security Centre warns that if you claim controls "are in place when they're not, the insurer may not be obliged to pay any claims."

One case shows the risk. In July 2022, Travelers sued International Control Services (ICS) in federal court in Illinois to rescind its cyber policy, Insurance Journal reported.

Travelers said the application, signed by the CEO, stated that ICS used MFA for administrative or privileged access.

After a May 2022 ransomware attack, Travelers said ICS "only used MFA to protect its firewall". In August, the parties jointly asked the court to declare the policy void "from its inception".

How to answer honestly

The TechGuard form shows what a signature commits you to:

Answer for the whole term. A Yes on MFA means enforced before inception and "continuously" through the policy period.
Match the scope. "All remote access" includes third parties and remote management tools.
Count every system. 100% of workstations and servers means every one.
Say No, then explain. Use the Additional Comments section for gaps and mitigating safeguards.
Report changes. Tell the insurer "immediately in writing" if an answer changes before cover starts.
Disclose what you know. The policy will not respond to incidents known before it began.
Involve the security owner. The form has a section for whoever is responsible for network security.

Watch for three easy errors: answering from policy documents, covering email but not cloud consoles, and leaving out a domain or subsidiary.

If a question's scope is unclear, check with your broker or counsel before you sign.

Template Answers

An answer that holds up names the scope, the exceptions and the evidence. Adapt these examples to what is actually true for you.

Question	Answer that holds up
MFA on privileged access?	Yes. Enforced on all admin, cloud, code host and backup accounts. Signers use hardware keys.
EDR on all endpoints?	No. All laptops and production servers are covered; two isolated build runners are not. See comments.
Backups tested?	Yes. Immutable, in a separate account behind MFA. Restores tested quarterly and timed.
Incident response plan?	Yes. It names who pauses contracts and reaches signers. Last tabletop held this quarter.
Crypto business?	Yes. We hold client assets in hot and cold wallets. Custody details attached.

For the incident plan itself, see how to write a Web3 incident response plan.

How Guardian Helps

Guardian is not an insurer or a broker. We help you prove the controls an application asks about.

Our Technical Evidence service keeps evidence current, such as a pentest with its retest, a signer inventory read from the chain and a timed restore.

MFA on every privileged path is tested once, with an identity provider export and a dated bypass attempt. Due diligence questionnaires are answered from the same evidence, so every answer agrees with every other one.

With Managed Security, Shield covers everything you expose to the internet, around the clock. Our security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

What questions are on a cyber insurance application?

Expect MFA on remote, email and privileged access, EDR coverage, backups, phishing training, payment checks, incident response, patching, critical vendors and three years of loss history. Crypto firms also face questions on key custody and signing controls.

Does cyber insurance cover stolen crypto?

Do not assume it does. The NAIC says cyber policies are highly customized, and Aon places hot wallet theft under crime cover. Ask your broker to confirm in writing which policy responds.

Can an insurer deny a claim over a wrong answer?

It can. The UK's NCSC warns an insurer may not be obliged to pay if declared controls were not in place. In 2022, Travelers and ICS jointly asked a court to void a cyber policy after a dispute over MFA.

What if we do not meet a control yet?

Answer No and explain in the comments: what is covered, what is not, the safeguards in place and when it will be fixed. A precise No is safer than an optimistic Yes.

Sources

Back every answer with evidence

Guardian tests the controls insurers ask about and packages the evidence, from MFA coverage to signer inventories.

Talk to Guardian Explore Managed Security