Which past incidents must I disclose on a cyber insurance form?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

In the past three years, has the Applicant experienced a network or computer system disruption due to an intentional attack or system failure; an actual or suspected data breach; an actual or attempted extortion demand;

During the last 5 years, has the Applicant experienced a network security breach, virus or malicious code attack, loss or theft of data (physical or digital), or a hacking or ransomware incident?

Sustained any losses due to wire transfer fraud, telecommunications fraud or phishing fraud?

In the past 12 months, have you or any other person or organization proposed for this insurance:

Please tick all the boxes below that relate to any cyber incident that you have experienced in the last three years (there is no need to highlight events that were successfully blocked by security measures):

If you ticked any of the boxes above, did the incident(s) have a direct financial impact of more than $10,000?

What does it mean for a small firm?

Some forms count a payment sent to a fraudster as an incident, even if no computer was broken into. One form says there is no need to list events your security measures blocked.

How do I answer it truthfully?

Go through the period the form names and write down each event with its date, what happened, what it cost and what you changed. Attach it where the form asks for details.

What can an outside reading show, and what can it not?

An outside reading can see which addresses at your domain are listed in breach data from other services. A listed address is one whose password may be known to strangers.

A listing in another service's breach data is not a breach at your firm. It cannot tell you what happened inside your firm.

Which questions sit next to this one?

• Known circumstances
• A wrong answer
• Incident response plan
• Money sent to a fraudster: what to do