A small business that asks for a cyber insurance quote gets a questionnaire before it gets a price. Plenty of owners treat it as paperwork and tick "yes" wherever the answer sounds reasonable. That's a waste. The form is the best security checklist a small company can get for free: it was written by people who pay the claims, and every question is there because a wrong answer already cost them. Our web services cover part of it, not all of it.
We read the Canadian applications that four insurers leave online (CFC, Coalition, Beazley and Chubb), the Insurance Bureau of Canada (IBC) guide, and the Canadian Centre for Cyber Security's baseline controls. No insurer recommendations and no premium figures here: the questionnaire reads as a work plan, and each ticked box binds you under Quebec law.
The short answer, for the busy
Before covering a small business, a cyber insurer has it fill out an application whose questions work, in practice, as a security checklist. The Canadian forms published by CFC, Coalition, Beazley and Chubb keep returning to the same points: multi-factor authentication on email, remote access and admin accounts; backups kept offline or off the network, with restores actually tested; patches applied within a known delay; endpoint protection; staff training; an incident response plan; verifying payment requests through a second channel; and incidents over the past three years. In Quebec, every answer is a representation governed by the Civil Code. An inaccurate answer given in good faith cuts the payout in proportion to the premium you paid versus the premium you should have paid (article 2411). Given in bad faith, or on a point that would have made the insurer refuse the risk, it lets the insurer ask for the contract to be annulled (article 2410). Answer for what is in place today, not what is planned.
What the published forms actually ask
One caveat: the forms insurers leave online date from 2018 to 2022, and the one your broker hands you may differ.
CFC's Canadian application fits its "basic risk questions" in three lines. Is multi-factor authentication always enabled on all email accounts? Do you keep daily offline backups of all critical data? Is any part of your IT outsourced, and to whom (up to ten providers)? Then come incidents in the last three years, and which ones cost more than $10,000.
Coalition's Canadian questionnaire (May 2022) adds multi-factor authentication on remote access and admin accounts, backups at least weekly kept offline or on a separate network, laptop encryption, and a question few owners expect: do you require a second means of communication to validate a funds transfer request above $25,000?
At the other end, Beazley's Canadian application spends about thirty questions on ransomware alone, and Chubb's, more detailed still, asks who hosts your website and whether you run software the manufacturer no longer supports. The IBC guide adds what you store (card numbers, social insurance numbers, health information) and how much of it, with simple advice: collect less.
Every "yes" is a representation under the Civil Code
In Quebec, a signed application binds you. Article 2408 of the Civil Code requires the client to represent all known facts likely to materially influence the insurer in setting the premium, appraising the risk or deciding to cover it. Article 2409 sets the bar: representations "such as a normally provident insured would make", without material concealment, and substantially true.
In damage insurance, the category a cyber policy falls into, a misrepresentation made in good faith doesn't kill the contract: the insurer pays a reduced indemnity, in the proportion the premium collected bears to the premium it should have collected (article 2411). But if bad faith is established, or the insurer shows it wouldn't have covered the risk had it known the facts, it can have the contract annulled (article 2410). When an insurer puts multi-factor authentication among its three basic questions, it's telling you how much that answer weighs.
Two more articles apply after you sign. If the policy turns an answer into a warranty, a breach that aggravates the risk suspends coverage until you fix it (article 2412). And a circumstance that increases the risk through your own actions must be reported promptly (article 2466).
The practical trap is the word "all". CFC asks about multi-factor authentication on all email accounts. The shared billing@ mailbox with no second factor, because it's easier that way, makes the "yes" false. A "no" with an explanation beats a shaky "yes", and Beazley provides a comment section for exactly that. One last habit: article 2400 obliges the insurer to give you a copy of your written application. File it with the policy. It's the list of what you promised.
The four projects that show up everywhere
Multi-factor authentication. Email, remote access, admin accounts: Coalition asks about all three, CFC about email, Beazley about email and privileged accounts. Beazley also asks the awkward one: can staff read email in a browser on a personal device, and is the second factor required when they do? In a small business the gaps are rarely on the owner's account. They're in the shared mailbox, a former contractor's login, or the domain registrar account.
Backups. CFC wants daily offline copies; Coalition, at least weekly copies offline or on a separate network. Beazley goes further: encrypted backups, access protected by a second factor and limited to dedicated accounts, a restore tested in the last six months, integrity checked before restoring. It also asks whether you use Dropbox, OneDrive, SharePoint or Google Drive as your backup. The question exists because a sync service copies every change to your files, including the ones ransomware makes. The restore test is covered in our article on website security for small businesses.
Patches and devices. Beazley asks how fast you install a critical patch, whether employees have admin rights on their laptops, and whether a detection and response tool watches your devices. For small organizations, the Cyber Centre offers the simplest answer: automatic patching everywhere and, for whatever can't take it, either replacement or regular manual updates (controls BC.2.1 and BC.2.2).
Payments. Coalition wants a second channel above $25,000. Beazley asks whether every change to a supplier's details is confirmed by calling the number that supplier gave you before the request came in, and whether the people who send payments are trained on fraud. The mechanics are in our piece on the first 72 hours of a ransomware attack; training employees is on CFC's list too.
The web layer: what your domain says about you
Several questions target the site and the domain directly. Coalition asks for your website domain or domains. Chubb asks who hosts your site and whether you assess vulnerabilities on your public websites. CFC's control list includes DMARC and a web application firewall, and Beazley asks whether you strictly enforce SPF on incoming mail. The Canadian Centre for Cyber Security recommends DMARC on all your email services (control BC.9.7).
A detail that matters: a DMARC record is public. Anyone can check in seconds whether the "yes" on your application is true. If the question reads like alphabet soup, our article on SPF, DKIM and DMARC explains it once and for all.
This is the part we handle: site updates, backups kept off the server, HTTPS, a second factor on hosting, registrar and site accounts, email records in order. The rest of the form (devices, the team's mailboxes, remote access, payments) belongs to your general IT, and the insurer won't care which vendor owns which line.
What the policy covers, and the clauses to read before signing
IBC distinguishes the stand-alone cyber policy, which it calls the most comprehensive option in Canada, from cyber coverage tucked into a property or liability policy, often with low limits, and from endorsements. The usual heads of cover (investigation, notification, data restoration, extortion) are summarized in our ransomware article. And coverage varies from insurer to insurer: the wording is what counts.
Three clauses deserve a careful read. First, known circumstances: Chubb, Beazley and Coalition make you disclose any fact that could lead to a claim, and Chubb's form excludes those facts from coverage, so an intrusion you suspected and kept quiet about wouldn't be covered. Second, the retroactive date: according to the notice at the top of Chubb's form, the liability side covers claims first made during the policy period for incidents after that date. Third, who responds: per the IBC guide, the insurer may connect you with its approved experts, or require you to use them. On the day, your first call goes to the insurer, before your usual IT person.
Buy or not: the Cyber Centre's position
The Canadian Centre for Cyber Security takes a position of sorts: control BC.1.3 recommends considering a policy that covers incident response and recovery, or documenting your reasons for not buying one. IBC, for its part, finds small businesses still vulnerable and underinsured, in a market that is stabilizing partly thanks to stricter underwriting.
The questionnaire is useful even if you buy nothing. Fill it out for yourself, honestly, then fix the "no" answers. Chubb and Beazley also ask whether your incident response plan has been tested: if you don't have one, our guide to the privacy incident response procedure gives you the structure.
Where to start
Answer CFC's three basic questions first, with the word "all" in mind. List your critical IT providers. Check the second factor at your registrar and your host, and test a restore. Only then call a damage insurance broker: you'll show up with true answers, and the price will be negotiated on facts.
→ Let's talk about the web layer of your questionnaire
This article explains how an insurance application works so a small business can ask the right questions; it is neither legal advice nor insurance advice. The forms cited are examples published by their insurers, not recommendations. Your policy wording and the Civil Code of Québec prevail: for your situation, talk to a damage insurance broker and, where needed, a lawyer.
Written byXavier Peich