Most companies that commission this service are not doing it because they woke up curious. They are doing it because someone has asked them to answer, in writing and under signature, a question they cannot currently answer with evidence.
The questionnaire is a legal document
A cyber insurance application asks whether specific controls are in place. It is answered by a person, from memory or from a vendor’s dashboard, and it is signed. That signature converts an informal belief into a representation on which the policy is priced and issued.
Insurers have contested claims on precisely that ground. The pattern is consistent and it is not exotic: a control genuinely deployed, genuinely believed to be universal, and absent from the one path the attacker actually used. In the best-known dispute of this shape, multi-factor authentication was in place on the firewall but not on the remote access method that was used to get in. The policy was not the problem. The answer on the form was.
Why an honest answer is hard
The person signing is rarely the person who configured the system, and the person who configured it may have left. The dashboard reports intent. The IT provider reports what was deployed. Nobody in that chain is reporting what a test would find today — and the gap between those two things is exactly where a denied claim lives.
This is not negligence. It is structural: no one in the chain is independent, and no one is asked to prove anything.
What verification changes
You answer the questionnaire from a dated document in which each claim was tested, with the evidence attached and the untested items named as untested. If a control does not hold, you find out before you sign rather than after you claim. If it does hold, you have something better than a recollection to put behind your signature.
We make no representation about how any particular insurer will treat the report, and any assessor who does is selling you something they cannot deliver. What we can say is narrower and more useful: the difference between a described control and a tested one is the difference the dispute turns on.
Send us the questionnaire
Before you commit to anything, send the form. We will tell you which of its questions this engagement can answer, which it cannot, and where the line falls between them.