Home/Resources/Renewal checklist
Renewal readiness checklistA phase-by-phase pre-renewal plan: baseline last year's answers against your live environment, remediate the gaps that carry the largest coverage consequence, and hand your broker an evidence-backed application.
Not insurance advice. This is a technical readiness checklist. Coverage decisions belong with your licensed broker.
Ninety days is the shortest runway that reliably works, for two reasons. First, remediation lead time: the gaps that matter most to underwriters, such as MFA coverage on remaining accounts, backup immutability, and privileged access review, each take weeks to close properly, and your broker typically wants the completed submission two to four weeks before the renewal date. Second, drift: your environment has changed since last year's application. New SaaS tools, new admin accounts, a migrated backup platform, staff turnover. An answer that was true when it was signed may be false today, and application answers are representations the carrier relies on. What follows is the plan in three phases, plus a triage order if your renewal is closer than 90 days.
If you are renewing for the first time or facing a new carrier's form, read the cyber insurance questionnaire guide for what applications ask, and the requirements guide for what carriers expect control by control.
The goal of this phase is a truthful map of where you stand: every prior answer classified as verified, attested, or gap. Do not fix anything yet. Fixing before you have the full picture wastes the remediation window on the wrong controls.
Work the ranked gap list from phase one, highest coverage consequence first. In most environments that means MFA, then backups, then privileged access, because those are the controls carriers most often treat as gating rather than merely rating.
The final phase turns verified answers into a submission the broker can present with confidence: evidence mapped per answer, a short drift brief, and a signer who has actually reviewed what they are signing.
The artifacts that support the answers most US carrier applications ask about. Collect these during the package phase, one mapped to each answer.
| Control area | Evidence to collect |
|---|---|
| Multifactor authentication | Conditional access or MFA policy export, enforcement coverage counts, list of excluded accounts with justification |
| Backup and recovery | Immutability or segregation configuration, backup scope, dated restore test record with outcome |
| Endpoint detection and response | EDR deployment coverage across endpoints and servers, monitoring arrangement |
| Privileged access | Privileged and global admin counts, dated access review record, PIM or just-in-time configuration if used |
| Email security | Current SPF, DKIM, and DMARC records with policy mode, phishing training completion records |
| Incident response | Written plan with revision date, dated tabletop or exercise record, log retention settings |
Compress the plan rather than skipping phases, and let coverage consequence set the order. Accuracy outranks completeness: a smaller set of verified answers with honestly documented exceptions is a stronger submission than a fully answered application nobody checked.
Most of the 90-day plan is spent building a baseline by hand: pulling last year's answers, checking each one against the environment, and classifying the result. With continuous, read-only scans of Microsoft 365, Entra ID, and Azure, that baseline already exists on day 90. Insurance Posture Analyzer keeps each mapped application answer cross-checked against the live environment and flags drift as it happens, so phase one becomes reading a report instead of running a manual audit.
The package phase compresses the same way: answers carry their evidence as they are attested and verified, gaps are graded by coverage consequence to set the remediation order, and the broker-ready drift brief collects what changed with the evidence files in one place. Scheduled rescans between renewals mean the next cycle starts from what is true today rather than from memory. Connections are read-only throughout; see the security page for the access model.
Ninety days before the renewal date. Remediation is the constraint: closing MFA coverage gaps, adding backup immutability, or completing a privileged access review each takes weeks, and brokers typically want the submission package two to four weeks before renewal. Ninety days leaves roughly a month each to baseline, remediate, and package.
Evidence mapped to specific answers: MFA policy exports and coverage counts, backup immutability settings plus a dated restore test, EDR coverage, privileged account counts with access review records, SPF, DKIM, and DMARC records, and a tested incident response plan. A short drift brief explaining what changed since last year is more useful to underwriting than an undifferentiated document dump.
Answer accurately and document the gap as an exception with a named owner, compensating controls, and a target date, then let the broker present it with that context. An accurate answer with a credible plan is a negotiation; an inaccurate one is a representation risk, as the rescission attempts in Columbia Casualty v. Cottage Health (2015) and Travelers v. International Control Services (2022) illustrate. Whether such an attempt succeeds depends on materiality and state law.
Compress, do not skip. Verify the answers with the largest coverage consequence first (MFA, backups, EDR), fix only what can realistically land before submission, and move everything else to a documented exception list. A smaller set of verified answers beats a fully answered application no one checked.
Connect a read-only account or upload last year's application. Insurance Posture Analyzer cross-checks every mapped answer against your live environment, so day 90 starts with the baseline already built.