--- title: "Does the Applicant have written information security policy reviewed and updated annually?" url: https://insuranceposture.com/questions/data-handling/applicant-written-information-security-policy-reviewed-updated-annually category: "Data handling and policy" canonical_key: q_dat_007 evidence_state: attested updated: 2026-08-24 --- # Does the Applicant have written information security policy reviewed and updated annually? URL: https://insuranceposture.com/questions/data-handling/applicant-written-information-security-policy-reviewed-updated-annually Section: Data handling and policy Evidence state: Attested, not tenant-verifiable The policy itself is rarely read by an underwriter. Its existence, its date, and whether reality matches it are what get examined. ## What the carrier is actually asking The carrier is asking whether a written information security policy exists, whether it is approved at an appropriate level, and whether it is reviewed and updated annually. Some forms ask which framework it aligns to, which is a separate question in the governance section. ## Why it is underwritten The policy is the document that makes every other control attributable to a decision rather than to habit. It also becomes evidence in litigation and regulatory inquiry, where a policy that describes controls the organisation does not operate is worse than no policy at all. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Policy documents live in your governance repository, so this is attested. The technical controls the policy describes are measurable, which is where drift becomes visible. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Policy repository | The policy document, its version, approval, and review date | Approved at management level, reviewed within the last year, with a documented review record. Attested | | Policy content | Coverage of access control, data handling, incident response, third parties, and acceptable use | The topics the rest of the application asks about are addressed rather than omitted | | Microsoft 365 | Whether the technical settings match what the policy asserts | Consistency between the stated policy and the configured state, which is where the document either helps or hurts | | Training records | Policy acknowledgement by workforce | Acknowledgement recorded at onboarding and on material change | | Exception register | Documented deviations from policy with owners and end dates | Exceptions handled explicitly, since an unrecorded deviation is a policy contradiction | **A policy that overstates is worse than none** If the policy says passwords rotate every sixty days and logs are retained for a year, and neither is true, you have documented the gap yourself. Regulators and plaintiffs read policies precisely because they are the organisation's own account of what it should have been doing. ## What a defensible yes requires - The policy is written, approved at management level, and dated within the last year. - It covers the domains the application asks about. - It matches what the environment actually does, or the differences are recorded as exceptions. - The workforce acknowledges it, and the acknowledgement is recorded. - The review is a real review, with a record of what changed. ## How this answer goes wrong The policy was written for a certification effort three years ago, describes an on-premises estate the organisation has since left, and has been reviewed in name each year without changes. It reads as current and describes a company that no longer exists, which is exactly the document you do not want quoted back to you. ## If this answer turns out to be wrong What regulated data you hold sets which covers respond, so an inaccurate answer here narrows the policy quietly rather than loudly. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### How long should it be? Long enough to cover the domains and short enough to be read. A concise policy with supporting standards works better than a single long document nobody opens. ### Does a template count? As a starting point. A template not adapted to your environment produces exactly the mismatch that causes trouble later. ### Who should approve it? Executive management or the board. Approval level is part of what the question is asking, because it establishes that security has ownership above the IT function. ### What does annual review mean? A documented review with a record of what was examined and what changed. A date stamp with no substance is what a claims review will characterise it as. ## Related questions - [Is the InfoSec policy aligned with NIST CSF, ISO 27001, or other framework?](https://insuranceposture.com/questions/governance-and-workforce/infosec-policy-aligned-nist-csf-iso-27001-other-framework) - [Does the Applicant have written privacy policy reviewed by attorney and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-privacy-policy-reviewed-by-attorney-updated-annually) - [Does the Applicant have a written Incident Response plan?](https://insuranceposture.com/questions/incident-response/applicant-written-incident-response-plan) - [Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?](https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.