The questions have converged across insurers. In roughly this order: Is multi-factor authentication enforced for all email and remote access? Is endpoint detection and response deployed on all devices? Are backups kept offline or immutable, and tested? Are operating systems supported and patched within 30 days? Is there a written incident response plan? Has staff had security awareness training in the last year? Are privileged accounts separated and monitored?
Each maps to a level on the Security Baseline. Most insurers will write a policy at Protected; better terms and fewer exclusions come at Monitored; some sectors are asked for Resilient.
The evidence matters as much as the answer. A claim can be refused if the questionnaire said yes and the post-incident forensics show otherwise. Under a managed agreement every answer has a document behind it: the MFA enforcement report, the endpoint protection coverage figure, the dated backup restore test, the patch compliance report, the training attendance.
If you are renewing in the next six months, request the assessment now. It tells you which questions you can honestly answer yes to today and what it takes to move the others.