The practical goal
Cyber-insurance applications frequently ask whether controls exist. A credible answer should be supported by evidence—not an assumption that a software subscription or informal practice is enough.
Use this kit to prepare for a broker or insurer conversation, identify evidence gaps, and connect insurance questions with the firm’s Written Information Security Plan (WISP). It is not an insurance application, does not guarantee coverage or pricing, and does not replace advice from a licensed insurance professional, attorney, or cybersecurity specialist.
How to use the kit
For every row:
- Record the firm’s current answer: Yes, No, Partly, Not Applicable, or Unknown.
- Name the person responsible for verifying the answer.
- Link or identify the evidence supporting it.
- Record when the control was last tested.
- Flag any difference between the written policy and actual practice.
Do not answer “Yes” solely because a vendor offers a feature. Verify that the feature is enabled, appropriately configured, and applied to every relevant account or device.
WISP-to-underwriting evidence crosswalk
| Application/control area | Evidence to assemble | Accounting-firm example | WISP / NIST CSF 2.0 connection |
|---|---|---|---|
| Organization, revenue, services, and locations | Current entity details, projected revenue, office/remote-work locations, service list | Tax preparation, bookkeeping, payroll, attest, advisory, or funds-handling services | Govern; Identify |
| Sensitive records and transactions | Data inventory, approximate record counts, payment-card activity, funds-transfer authority | SSNs, returns, W-2s, bank details, payroll records, PTIN/EFIN/CAF credentials | Identify |
| Prior incidents and circumstances | Incident log, claim history, unresolved alerts, corrective-action records | Phishing compromise, fraudulent filing, lost device, ransomware, suspicious e-file activity | Govern; Detect; Respond |
| Formal risk assessment | Dated risk assessment, asset inventory, risk register, remediation owner | Annual review of tax software, file portals, email, endpoints, remote access, and vendors | Govern; Identify |
| Written security and incident-response plans | Current WISP, incident-response plan, approval record, review date | WISP owner, escalation contacts, IRS/state notification steps, insurer/broker contact | Govern; Respond; Recover |
| Multifactor authentication | Admin reports or screenshots showing MFA enforcement and exception list | Email, tax software, cloud storage, remote access, administrator and e-services accounts | Protect |
| Backups and restoration | Backup configuration, separation/immutability evidence, latest successful restore-test record | Encrypted backups of client files and critical configurations, with a documented restore test | Protect; Recover |
| Endpoint and malware protection | Endpoint inventory, protection coverage report, alert/response procedure | Managed protection on every laptop, desktop, and server used for client data | Protect; Detect |
| Patching and end-of-life systems | Patch reports, supported-software inventory, exception/remediation log | Supported operating systems, browsers, tax applications, plugins, routers, and remote-access tools | Identify; Protect |
| Access provisioning and termination | User list, approval process, least-privilege review, departure checklist | Immediate removal of former staff and seasonal preparers from email, portals, tax software, and e-services | Govern; Protect |
| Encryption | Device-encryption report, secure-transfer settings, key-management description | Full-disk encryption and approved encrypted client portal rather than ordinary email attachments | Protect |
| Security awareness | Training roster, phishing-test results, remediation record | Pre-season training and refreshers on phishing, e-file credential theft, remote-support scams, and payment fraud | Govern; Protect |
| Service-provider oversight | Vendor inventory, security review, contracts, breach-notification and access provisions | Tax software, payroll, cloud storage, IT provider, document portal, payment processor, and shredding service | Govern; Identify |
| Business continuity and disaster recovery | Business-impact analysis, recovery priorities, continuity plan, exercise results | Alternative access to critical records and filing workflows during a system or vendor outage | Govern; Recover |
| Funds-transfer and change verification | Written call-back procedure, approved contact list, dual-authorization thresholds | Independently verify bank-detail or payment-instruction changes using a pre-established contact channel | Protect; Detect |
Evidence-quality test
Assign each control one evidence level:
| Level | Meaning | Example |
|---|---|---|
| 0 — Unknown | Nobody has verified the answer | “Our IT provider probably handles it.” |
| 1 — Stated | A policy or person says the control exists | WISP says MFA is required, but there is no configuration evidence |
| 2 — Implemented | Current configuration or operational evidence exists | Admin report shows MFA is enforced for email users |
| 3 — Tested | Evidence shows the control was tested and gaps were handled | Restore test completed, documented, and failed items remediated |
The score is an internal preparation indicator, not an insurer’s underwriting score:
- 0–15: Evidence is incomplete; verify controls before representing them on an application.
- 16–30: Key controls exist, but documentation or testing needs work.
- 31–39: Stronger evidence set; confirm scope, exceptions, and current configuration.
- 40–45: Well-documented preparation; still answer the actual carrier application exactly as written.
Pre-submission accuracy check
- Has an authorized person reviewed every answer?
- Are “Yes” answers true for the full scope named in the question?
- Are exceptions, partial implementations, or planned improvements disclosed accurately?
- Do answers match the WISP, vendor contracts, incident log, and technical reports?
- Have material changes since the quote request been reported to the broker or insurer?
- Has the firm preserved the completed application and evidence used to support it?
Insurance applications commonly warn that false, incomplete, or misleading information can affect quoting, binding, or coverage. Ask the broker or insurer to explain unclear questions; do not infer definitions.
Source and methodology notes
This crosswalk is derived from recurring control areas visible in public insurer application materials and aligned to federal tax-professional security guidance. It does not reproduce or substitute for any carrier’s current application.
- IRS identity-theft information for tax professionals
- IRS Publication 5709: How to Create a WISP
- FTC Safeguards Rule
- NIST CSF 2.0 for Small Business
- CISA cybersecurity guidance for small and medium businesses
- Chubb public cyber and privacy insurance application
- The Hartford CyberChoice application
- Coalition application-information guide
Related resources
- Cyber liability insurance for small business
- Cyber insurance for accountants
- Tax-preparer WISP requirements
- WISP readiness scorecard
- Tax and accounting WISP template
Last reviewed: October 12, 2026. This HTML resource is the primary version and should be rechecked against the actual carrier application being completed.
