Vendor Underwriting Questionnaire for Your Cyber Policy Renewal

Your cyber insurance premium dropped 2% this quarter. Your broker called it good news. But while you were celebrating the rate decrease, your insurer quietly added a sublimit to your Contingent Business Interruption coverage and introduced a widespread-event exclusion tied to third-party failures.

This is the soft market paradox: falling premiums are masking a fundamental shift in what your policy actually covers when a vendor fails. Third parties were involved in 48% of analyzed breaches in recent data, a 60% increase year-over-year. Insurers see the aggregation risk. They're managing it through coverage restrictions, not premium increases.

The problem is that most renewal questionnaires don't capture the information underwriters now want about your third-party dependencies. Below is a template you can use to inventory your vendor risks before your renewal. It's designed to answer the questions insurers are asking and to surface the exposures that might trigger sublimits or exclusions in your next policy.

Purpose of the Template

This questionnaire helps you document your reliance on external technology providers in a format that supports both underwriting discussions and your own vendor risk management. Use it to:

• Identify which vendors could trigger Contingent Business Interruption claims.
• Assess whether your current vendor contracts actually transfer risk.
• Prepare for underwriter questions about cloud concentration and SaaS dependencies.
• Determine where you need compensating controls to maintain full coverage.

Prerequisites

Before you complete this template, gather:

• Your current vendor inventory (IT, cloud, SaaS, managed services).
• Copies of vendor contracts, particularly liability limitation and indemnification clauses.
• Network architecture diagrams showing vendor access points.
• Your business continuity plan, specifically vendor-related recovery procedures.
• Your current cyber insurance policy, including any sublimits or exclusions related to third-party failures.

The Template

Section 1: Critical Vendor Identification

For each technology vendor that supports revenue-generating operations:

• Vendor name and service type (cloud infrastructure, SaaS application, managed security, payment processing, etc.).
• What business function becomes unavailable if this vendor experiences an outage?
• Maximum tolerable downtime before you experience material revenue loss (hours/days).
• Estimated daily revenue impact during a vendor outage.
• Do you have a documented workaround or alternate provider? (Yes/No/Partial).

Section 2: Cloud and SaaS Concentration

• Primary cloud infrastructure provider(s).
• Number of revenue-critical applications hosted on each provider.
• Can you operate core business functions without this provider for 72 hours? (Yes/No).
• Do you maintain on-premises failover capacity? (Yes/No/Partial).
• Have you tested failover procedures in the past 12 months? (Yes/No).

Section 3: Vendor Access and Segregation

For each vendor with network access:

• What level of access does this vendor have? (Read-only, administrative, privileged).
• Is vendor access restricted to specific network segments? (Yes/No).
• Do you require multi-factor authentication for vendor access? (Yes/No).
• Can you revoke vendor access within 24 hours if needed? (Yes/No).
• Do you monitor vendor access in real-time? (Yes/No/Partial).

Section 4: Contractual Risk Transfer

For your top five revenue-critical vendors:

• Does the contract include a liability cap? If yes, what is the cap amount?
• Does the liability cap cover your potential Contingent Business Interruption loss?
• Does the vendor indemnify you for security failures? (Yes/No/Limited).
• Does the contract require the vendor to maintain cyber insurance? If yes, what limits?
• Have you reviewed whether the vendor's insurance would respond to a claim affecting your business? (Yes/No).

Section 5: Vendor Management Controls

• Do you conduct annual security assessments of critical vendors? (Yes/No/Partial).
• Do you require vendors to notify you of security incidents within a specific timeframe? If yes, what timeframe?
• Do you maintain an updated inventory of all vendors with access to Nonpublic Information? (Yes/No).
• Do you have documented procedures for vendor incident response? (Yes/No).
• Have you conducted a tabletop exercise involving a vendor security failure? (Yes/No/Date of last exercise).

Customizing the Template

This template covers the baseline questions underwriters are asking about third-party dependencies. Customize it based on your industry and technology architecture:

If you operate critical infrastructure: Add questions about vendor compliance with CIRCIA reporting requirements and whether vendor incidents would trigger your own reporting obligations.

If you're in a regulated industry: Include questions about vendor access to regulated data and whether vendor contracts address regulatory liability.

If you use multiple SaaS providers for the same function: Document your ability to switch providers and how long a transition would take.

If you outsource IT or security operations: Add detailed questions about the managed service provider's incident response capabilities and whether they maintain their own cyber insurance.

The revenue impact estimates don't need to be precise, but they should be defensible. Underwriters want to understand order of magnitude: is this a $10,000-per-day exposure or a $1 million-per-day exposure?

Validation Steps

After completing the questionnaire:

Compare your answers to your current policy. If you identified vendors that could cause a week-long revenue interruption, check whether your Contingent Business Interruption coverage has a sublimit that's lower than your potential loss. If it does, you're underinsured for that scenario.

Review vendor contracts against your answers. If you indicated that a contract transfers risk, pull the actual indemnification clause and read it. Many vendor agreements contain carve-outs that eliminate coverage for the exact scenarios that would trigger a Contingent Business Interruption claim.

Share the completed questionnaire with your broker before renewal. Don't wait for the underwriter to ask. Proactively demonstrating that you understand your vendor dependencies and have controls in place can help you avoid restrictive sublimits or exclusions.

Use gaps as a vendor management roadmap. Anywhere you answered "No" or "Partial" represents an exposure that insurers will either price, exclude, or sublimit. Closing those gaps before renewal gives you more negotiating leverage.

The soft market won't last forever, but the underwriting focus on third-party risk isn't going away. Insurers are managing aggregation exposure through coverage terms because they can't fence cyber risk by geography the way they do with property catastrophes. Outsourcing the function doesn't outsource the risk, and neither does buying a cyber policy. This questionnaire helps you see where the gaps are before an incident forces you to discover them.