Do I need an incident response plan to answer a cyber insurance form?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you have an incident response plan for network intrusions and malware incidents?

An incident response plan to respond to a network intrusion

Are all plans indicated above tested regularly with any critical deficiencies remediated?

What does it mean for a small firm?

A plan says who is called first, who can shut systems down, who speaks to the insurer, the bank and clients, and where the phone numbers are kept when email is down.

How do I answer it truthfully?

Write the plan, even one page. Include what to do in the first hour after money is sent to a fraudster. Then answer Yes. One form asks whether it is tested, so note when you last walked through it.

Can an outside reading check this?

An outside reading cannot see your plan. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• Backup testing and restore time
• Past incidents
• Money sent to a fraudster: what to do