Contents
Short answer
Depending on insurer, company size, sector and risk, questions may cover data backups, security updates, accounts and admin rights, malware protection, previous losses and external service providers, among others. Answer completely and truthfully, and never confirm a measure that isn’t actually in place.
Application question and obligation: not the same
Application question / acceptance criterion
What the insurer wants to know before the contract to assess the risk and decide on acceptance.
Contractual obligation (Obliegenheit)
A duty arising from the signed contract, such as security measures before a loss or reporting duties afterwards.
Why it matters
A measure asked about in the application isn’t automatically identical to a later obligation – content and wording can differ. The fact that a security measure is set out as an obligation in the policy conditions does not automatically mean the same measure was previously asked in identical form as an application question. What counts are the application, policy schedule and conditions.
Typical topics in the application
- Data backup: frequency, separate storage, protection and testing of recovery
- Security updates and patch management
- Handling of systems that no longer receive updates
- Individual user accounts and password quality
- Restricted administrator rights
- Additional access protection, such as encrypted remote access
- Malware protection on servers and endpoints
- Network separation and firewalls
- Previous losses and known security incidents
- Sector, turnover and business areas such as e-commerce
- External IT service providers and data processing by third parties
Step by step
Example of contractual security obligations: Hiscox CyberClear. The following examples come from the Hiscox CyberClear policy conditions 01/2026 (section 15). They show contractual obligations before an insured event occurs. They do not show that Hiscox asks about the same points or thresholds in this form in its current application. Data backup (15.1): at least a weekly full backup, either offline with permanent physical separation or the immutable online backup described in the conditions, kept for at least 30 days. Patch management (15.2): security updates on the systems named there within 30 days of the manufacturer’s release. Legacy systems (15.3): systems without security updates only in an isolated network environment, without direct internet access and with continuous monitoring of data traffic. This is a provider example, not a general industry standard.
- 01
Establish the actual state
Before applying, clarify with your IT what is really in place: backups, updates, accounts, malware protection.
- 02
Read questions carefully
Watch for wording such as “all systems”, “at least weekly” or “stored separately”. Partial implementation is not a “yes”.
- 03
Answer truthfully
Don’t confirm a measure that isn’t in place – not even intending to implement it later.
- 04
Raise gaps openly
If you can’t answer a question with yes, talk to your broker or insurer. Explanations, conditions or deadlines are sometimes possible.
- 05
Check obligations after signing
After the contract is concluded, read the obligations and comply with them on an ongoing basis.
- 06
Document
Record how and when measures were implemented. That helps with queries and in a claim.
Checklist
- The actual state of backups, updates, access and malware protection is clarified with IT.
- Every application question is answered completely and truthfully.
- Partially implemented measures are not confirmed as complete.
- Previous losses and known incidents are disclosed.
- Obligations from the conditions are known and complied with.
- Implementation is documented.
Common mistakes
- Ticking “yes” and hoping to implement the measure later.
- Answering application questions without checking with IT.
- Leaving out small past incidents.
- Treating application questions and later obligations as identical.
- Treating one insurer’s requirements as the market standard.
Frequently asked questions
Do I need MFA?
It depends on the insurer. Access protection is often asked about; whether multi-factor sign-in is a requirement follows from the application and conditions.
Which backups are required?
It varies. Often it’s about regular backups that are stored separately and protected. Some providers specify frequencies and retention periods.
What if I can’t answer a question with yes?
Answer truthfully anyway and talk to your broker or insurer. Incorrect or incomplete information can affect the contract and your cover.
Are requirements the same at every insurer?
No. They differ by insurer, company size, sector and risk.
Do I need advice?
If you’re unsure, individual insurance or legal advice can make sense.
Sources
- GDV – Unverbindlicher Muster-Fragebogen zur Risikoerfassung Cyber (Stand 12/2019)
- GDV – Unverbindliche Musterbedingungen AVB Cyber (Stand 02/2024)
- Anbieterquelle: Hiscox CyberClear Versicherungsbedingungen, Stand 01/2026, Abschnitt 15
Checked on 7 October 2026.
This content is for general guidance only and does not replace individual insurance advice, legal advice or a technical security review. What counts are the relevant policy conditions, the policy schedule and the specific case.