How do I answer the cyber insurance questions about payment cards?
The forms ask whether you take card payments, whether you meet the card industry's security standard (PCI DSS) and whether you have been investigated under it.
Last read from the sources at the foot of this page.
What exactly does the form ask?
These are the forms' own words, with the form and page each comes from.
Is the Applicant currently compliant with Payment Card Industry Data Security Standards (PCI-DSS)?
Has the Applicant been subject to a PCI investigation?
What does it mean for a small firm?
If a payment provider takes the card on its own page, you hold less card data, but you still take cards. The forms ask either way.
How do I answer it truthfully?
Ask your payment provider which PCI self-assessment applies to you and whether it is current. Answer with that and its date.
Can an outside reading check this?
An outside reading cannot see how you take cards. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.
Where does this come from?
- Travelers, CyberRisk Application (CYB-14102 Ed. 01-19)travelers.comRead 14 October 2026
- Northbridge Insurance, Cyber Risk Insurance Application (short form, 3838-005-ed03E)broker.northbridgeinsurance.caRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/