---
title: Data handling and policy questions on cyber insurance applications
url: "https://insuranceposture.com/questions/data-handling"
section: Data handling and policy
questions: 11
updated: 2026-08-24
---

# Data handling and policy: what cyber insurance applications ask

What regulated data you hold, how it is encrypted and prevented from leaving, and which written policies stand behind those answers.

## 11 questions in this section

- [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci) (partly verifiable from your tenant)
- [Does the Applicant collect biometric information (fingerprints, voice, face, iris, etc.)?](https://insuranceposture.com/questions/data-handling/applicant-collect-biometric-information) (attested, not tenant-verifiable)
- [Is the Applicant PCI-DSS compliant, and at what merchant level?](https://insuranceposture.com/questions/data-handling/applicant-pci-dss-compliant-at-merchant-level) (attested, not tenant-verifiable)
- [Has the Applicant confirmed HIPAA compliance?](https://insuranceposture.com/questions/data-handling/applicant-confirmed-hipaa-compliance) (attested, not tenant-verifiable)
- [Is sensitive data encrypted in transit?](https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit) (verifiable from your tenant)
- [Is the Applicant compliant with cross-border data transfer laws?](https://insuranceposture.com/questions/data-handling/applicant-compliant-cross-border-data-transfer-laws) (partly verifiable from your tenant)
- [Does the Applicant have written information security policy reviewed and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-information-security-policy-reviewed-updated-annually) (attested, not tenant-verifiable)
- [Are users able to store data to the hard drive of portable computers or portable media devices?](https://insuranceposture.com/questions/data-handling/users-able-store-data-hard-drive-portable-computers-portable) (partly verifiable from your tenant)
- [Does the Applicant employ Data Loss Prevention (DLP)?](https://insuranceposture.com/questions/data-handling/applicant-employ-data-loss-prevention) (verifiable from your tenant)
- [Does the Applicant have written privacy policy reviewed by attorney and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-privacy-policy-reviewed-by-attorney-updated-annually) (attested, not tenant-verifiable)
- [Do users store business-critical information locally on their systems rather than on centralized storage?](https://insuranceposture.com/questions/data-handling/users-store-business-critical-information-locally-systems-rather-than) (partly verifiable from your tenant)

Full index: https://insuranceposture.com/questions

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.