In this article 9 sections
Your client’s broker sends across a 60-question form, asks you to fill out the security side, and then either signs the renewal or doesn’t.
Here is how to handle it without losing evenings or giving away unbilled work.
Why are clients asking MSPs to fill in cyber insurance questionnaires now?
Three things changed in the last two years.
First, insurer loss ratios on UK SME cyber policies got ugly enough that most carriers tightened underwriting. Beazley, Hiscox, AIG, Travelers all rewrote their proposal forms in 2023 and 2024 to ask sharper, more technical questions. Your client used to get a 10-question form. Now they get 50 to 80.
Second, the questions stopped being check-box and became evidence-led. “Do you have MFA?” became “What percentage of privileged accounts have phishing-resistant MFA, and how is that measured?” That’s not a question a non-technical CEO can answer.
Third, the broker market consolidated, and the broker now has commercial pressure to verify the answers. If they accept a wrong answer and the client claims, the broker is on the hook. So the broker pushes the questionnaire to the MSP.
That’s why the questionnaire arrived in your inbox. It’s the broker outsourcing the underwriting work because they don’t have the technical knowledge in house. Treating it as anything else gets you the wrong answer.
(For your own MSP, Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live measures such as patching and supported operating systems are refreshed every six hours, other controls on a set cycle. The result sits on a Trust Portal anyone can open, with a dated record of each control. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly. Trustmark holders get up to 25% off their own professional indemnity and cyber insurance with Hiscox, CFC and Beazley, subject to underwriting.)
What does a typical cyber insurance questionnaire actually ask for?
Most questionnaires now cluster into 6 areas. Get familiar with all 6 because they show up everywhere with slight rewording.
- Identity and access controls. MFA on email, VPN, RMM, PSA, admin accounts, customer admin accounts. Phishing-resistant MFA is increasingly asked for separately. Privileged Access Management. Joiner-mover-leaver process timing.
- Endpoint protection and EDR. Coverage percentage, vendor name, alert response SLA, who responds, whether it’s monitored around the clock.
- Patching and vulnerability management. Critical patch SLAs, internal vs perimeter scanning frequency, exception management.
- Backup and recovery. Immutable backups, offsite copies, last test date, RTO and RPO, segregation of backup admin from production admin.
- Email and phishing controls. SEG, DMARC enforcement (not monitor), simulated phishing, training programme.
- Incident response and governance. Documented IR plan, last tabletop exercise, breach notification process, supplier risk register.
You won’t see every category in every questionnaire, but you’ll see most. Build your master answer library around these 6 buckets and most of any future questionnaire is already drafted.
The trick is structure. The first MSP to learn this lesson the hard way ends up with a 40-page Word document that nobody can find anything in. The MSP that does it right keeps the answers in a single source of truth, mapped to the evidence that backs each one.
How do you build a master answer library that doesn’t rot by year 2?
Most MSPs build the library wrong the first time. They take the first big questionnaire that lands, save the completed Word doc into a SharePoint folder labelled “client questionnaires,” and reuse it. Six months later the answers are out of date, the technician who wrote them has left, and the new technician adds a slightly different answer to a new questionnaire because they couldn’t find the old one.
Three rules to avoid this.
Rule 1: One library, one structure
The library lives in one place, organised by the 6 question categories above. Not 40 client folders with 40 versions. One canonical source of truth, owned by one named person.
Rule 2: Every answer has a date and an owner
“Patching SLA: 14 days for critical, last reviewed 15/04/2026 by Sam Lewis.” If the answer is older than 6 months and unreviewed, it gets flagged. If the owner has left the business, the next owner has to confirm the answer before it goes out.
Rule 3: Answers reference evidence
Don’t write “we have MFA on all admin accounts.” Write “MFA enforced on all admin accounts via Conditional Access policy CAP-007, evidence: M365 Conditional Access export from 12/04/2026.” When a sceptical broker pushes back, you don’t have to dig. The evidence reference is right there.
The brief from a senior security decision-maker at a London architectural practice last year was specific: “I don’t want a marketing answer. I want the date the policy was last tested and the name of the person who tested it.” That’s the bar.
Should MSPs charge clients for filling in their questionnaire?
Yes, with one exception.
Big-picture, the answer is yes for new business and yes for renewal-driven questionnaires that arrive outside your standard service description. The work is non-trivial. A 60-question proposal form done properly takes 4 to 8 hours of senior engineering time, plus review. If you’re not charging, you’re absorbing roughly £500 to £1,200 per client per year in unbillable work.
The exception is the first questionnaire after onboarding a new client, where you cover the cost as part of the win. Anything after that, you bill.
The way to bill it without friction is to scope it as a defined, named line item in your service description. “Annual cyber insurance evidence pack: included for clients on the Premium tier, £750 fixed fee for clients on Standard.” Now it’s a fee with a named output, not a surprise invoice.
The dual benefit: the named line item also frames the evidence pack as a thing of value, which makes the Premium tier look better.
What does good look like when a broker pushes back?
The broker push-back arrives roughly 30 percent of the time on a properly completed questionnaire. It’s usually a single email that says “your client’s underwriter has a follow-up question on point 17.”
There are three response levels.
Level 1: The answer is in the library and current
Reply within one working day. Quote the answer. Attach the evidence reference. Done.
Level 2: The answer was correct when written but the policy has shifted
Update the library, reply within 2 working days with the new answer, flag the change to the client so they know what was updated. This is normal. The library is supposed to evolve.
Level 3: The answer reveals a gap
This is the meaningful one. The questionnaire surfaces a control you don’t currently have or aren’t currently enforcing. There are two correct moves: don’t lie, and don’t panic. Be honest about the current state, explain the remediation timeline (4 to 12 weeks for most controls), and turn the gap into a billable improvement project.
The gap conversation often leads to a paid project. The broker exposed a weakness, the client now knows about it, and you can scope a project to close it.
How often should the answer library be reviewed?
Quarterly is the floor, monthly is realistic for any answer that ties to a metric that moves.
The four metric-linked categories that move every month:
- Patch compliance percentage
- MFA coverage percentage
- Backup test status
- Phishing training completion
Rev them monthly. Park the rest on a quarterly cycle. Schedule a 30-minute review meeting between the head of operations and the head of security. Two of you, calendar locked, no agenda surprise.
If those reviews keep slipping, the questionnaire library will rot, and you’ll find out when the next big questionnaire lands and you have to start from scratch. The rot is silent until it’s not.
How do you turn the questionnaire process into a sales tool?
A completed, current, evidence-backed answer library is a sales asset. It demonstrates operational maturity, it’s specific, it’s defensible, and it’s something most of your competitors don’t have.
The play is simple. When a prospect mentions cyber insurance in a sales conversation, and after 2024 they all do, pull up your answer library on screen. Walk them through one section. Show them how an answer connects to live evidence. The implicit message: “This is what working with us looks like. Your insurer questions become our problem.”
That single 3-minute walkthrough closes more deals on price than any other piece of sales theatre we’ve seen at Assurix.
For a first-meeting hook, you can also offer the prospect a free review of their existing insurance questionnaire response. Most of them have a thin one and they know it. The review is short, it’s high-value, and it surfaces gaps that make your replacement bid easy to defend.
Frequently asked questions
Should we sign a non-disclosure before sharing our questionnaire library with a prospect?
No. Non-disclosure on a sales asset means it’s not really an asset. Share confidently. The library is a competitive advantage you should be using actively.
What if a prospect’s broker uses a non-standard questionnaire format?
Map it back to your 6-category structure and answer per category. Most non-standard questionnaires are a different layout of the same questions.
Do we have to answer every question?
No. If a question doesn’t apply, say so and explain. “Not applicable, client environment is fully cloud-based, evidence on request” is a legitimate answer.
What if the client asks us to lie?
Don’t. The MSP is named on the proposal form. If the policy is invoked and the answer was wrong, the insurer will take it up with the MSP, not the client. There’s no upside.
How much does a full evidence pack take to build the first time?
About a week of focused work for a 50-client MSP, depending on how mature the existing documentation is. After that, 4 to 8 hours per quarter for upkeep.
The closing principle
Build the library. Tie every answer to dated evidence. Charge for the work. For your own MSP’s controls, the Assurix Trustmark holds that evidence, from 2 hours a week.
