§ Cybersecurity proof & diagnostic assets·print-friendly · evidence register

The control evidence a cyber-insurance application asks for.

Underwriting questionnaires increasingly ask you to prove controls, not just claim them. This register lists the artifacts applications commonly request, with a column to record the evidence you will attach and its as-of date — so your answers are supportable representations.

About this asset

Audience: Owners and IT/security leads assembling evidence for a cyber-insurance application or renewal — and for enterprise-customer security questionnaires.
Owner service: Cyber Insurance Evidence Readiness Assessment
Classification: Classification: Public · Version 1.0 · July 2026
Methodology: The control areas reflect the essential-hygiene controls carriers commonly ask about, organized around outcomes in NIST Cybersecurity Framework 2.0 (NIST CSWP 29) and the CISA Cross-Sector CPGs. Specific questions and thresholds vary by carrier; this is an evidence-gathering aid, not a policy.
Limitations: Point-in-time, self-diagnostic checklist you complete yourself. It is not a DSE assessment, an audit, insurance advice, a broker service, or legal advice, and it produces no eligibility, premium, or claim determination.
Verification: The framework references were checked against the csrc.nist.gov and cisa.gov landing pages linked below. Control areas are stated generically; no carrier, form, or coverage outcome is named or implied.

The evidence register

Attach the artifact, date it.

For each control, note the evidence you will attach and the date it reflects. A dated, evidence-backed answer is easier to support later than a bare “yes”. How you answer any application question is a decision for you, your broker, and your counsel.

Cyber-insurance evidence register — complete the evidence and as-of-date columns yourself
Control area	Evidence artifact to attach	As-of date
MFA coverage	Report or export showing MFA is enforced on email, remote access, and privileged accounts, and where any exceptions remain.	__________
Endpoint detection & response (EDR) coverage	Deployment report showing EDR coverage across servers and workstations, and the count of unmanaged endpoints.	__________
Backup & restore testing	Evidence of recent, tested backups — a timed restore log and an offline/immutable-copy confirmation.	__________
Incident response plan	The written IR plan and the date of its most recent test or tabletop.	__________
Patching cadence	Evidence of a documented patch/update cadence and current status for internet-facing and critical systems.	__________
Privileged-access controls	Admin-account inventory, separation of privileged accounts, and how elevated access is protected and reviewed.	__________
Security-awareness training	Records of staff security-awareness and phishing training, with completion rates and the last training date.	__________

Want the eight artifact bundles broken down further, including why a qualified yes beats an unsupported yes? Read the deep dive.

Make the evidence pack real before you apply.

A free 30-minute Cyber Risk Check scopes a readiness engagement that assembles and dates this evidence — the same pack that answers enterprise-customer questionnaires — so your representations are supportable.

Book a free 30-minute Cyber Risk Check → Cyber Insurance Evidence Readiness →

What this is and is not. A point-in-time, self-diagnostic evidence checklist. DSE is not an insurance broker, agent, or carrier and guarantees no eligibility, premium, or claim outcome. Carrier requirements vary — your application answers are your representations. It is not a DSE assessment, an audit, insurance advice, or legal advice. See the deep dive for the full artifact breakdown.

Primary sources, verified.