What information do I need for a cyber insurance quote in Texas?

By Mark Melliand, owner, Melliand Insurance Agency · 13 years as an independent agent · Published October 28, 2026

The short answer

What an insurer asks for depends on the insurer, the application and your business. The reviewed applications ask about some combination of:

your business and revenue
the personal or payment information you handle
the technology and vendors you rely on
your security controls, such as multi-factor authentication, backups and patching
past incidents or claims
current insurance
the coverages and limits you want

Having those answers ready, and having your IT contact check the technical ones, can make the process smoother.

This guide is based on three cyber applications and one supplement published by U.S. insurers. They are illustrative examples, not confirmed current Texas requirements, and another insurer may ask different questions. For what cyber insurance can cover, see our guide to what cyber insurance covers.

The applications we reviewed

These forms are different editions from different insurers, so each question below is attributed to the form that asks it. The Chubb form is a 2016 edition and the Travelers application is a 2019 edition. Newer applications may ask more, or differently. Some questions apply only to certain applicants, as noted below.

Business identity and operations

The reviewed applications ask for basics such as the applicant’s name and address, website, year established, industry code (NAICS), revenue and employee count. Specifically:

Travelers asks for total assets and annual revenues as of the most recent fiscal year-end, plus entity type.
Beazley asks for a business description, number of employees, revenue for the most recent and current (projected) fiscal years, and whether you have revenue-generating operations outside your home country.
Chubb asks for subsidiaries to be covered, ownership structure, global and domestic revenue, online revenue and total employees.

Applications may also ask about specific business activities. Beazley asks whether the applicant is engaged in listed activities, such as payment processing or hosting data for others as a professional service. Chubb asks about planned new markets and certain business types. Travelers’ application states that affiliates, other than subsidiaries as defined in its coverage, aren’t covered unless the insurer agrees to schedule them by endorsement. Have your legal entity name, any DBAs and a list of related companies ready, and ask which should be included.

Data you collect or store

Applications ask what kinds of information you handle and roughly how much.

Types of data. The Travelers application asks whether you, or a third party on your behalf, handle credit or debit card data, medical information other than your own employees’, non-employee Social Security numbers, and employee or HR information. For card data, it asks about PCI compliance and transaction volume.
How many people or records. Each application defines its count differently. Travelers asks for “the approximate number of unique individuals” whose personal information of the listed types you or a third party on your behalf collect, store or process, using ranges. Chubb asks for the “maximum total number of unique individual persons or organizations” whose protected information could be compromised or will be stored or transmitted during the policy period. It tells applicants to include information held by third parties under contract, and to count multiple records about the same person or organization as one record. Read the definition on the application you’re completing before you estimate.
Encryption and storage. Travelers asks whether data is encrypted at rest, in transit, on mobile devices, on employee-owned devices, and while held by third-party service providers.

Technology, cloud services and vendors

Insurers want to know what you depend on. The Travelers application asks which services are outsourced and to which provider, such as data backup, payment processing, data center hosting, IT infrastructure, IT security, web hosting and data processing. For hosting or IT infrastructure, it asks the likely impact if those services became unavailable, and whether you have an alternative. In its additional-controls section for applicants with revenues greater than $35 million, Beazley asks whether a cloud-based backup service is a “syncing service” (examples given: DropBox, OneDrive, SharePoint, Google Drive).

Prepare a list of your key systems and providers, such as email, accounting or practice-management software, cloud storage, payment processor and outsourced IT. Note which ones would stop your operations if they went down. For how dependent business interruption can work, see our cyber coverage guide.

Security controls

This is usually the most detailed part of an application. Questions vary by insurer and edition.

Multi-factor authentication (MFA). The Travelers application asks about MFA for administrative or privileged access, for remote access to the network, and for remote access to email. The Travelers MFA supplement asks separately about email accessed through a website or cloud service; all remote network access for employees, contractors and third-party providers; and administrative access to directory services, backup environments, network infrastructure, and endpoints or servers. Beazley asks about MFA for remote network access and for web-based email.
Endpoint protection. Beazley asks whether all company devices have anti-virus, anti-malware or endpoint protection software. Its additional-controls section, which applies only to applicants with revenues greater than $35 million, also asks which endpoint protection, endpoint detection and response, or managed detection and response products are used, and whether a hardened baseline configuration is used across devices.
Patching and outdated systems. Travelers asks whether patches are regularly tested and installed, whether that process is automated, and how quickly critical patches are installed. Beazley asks whether critical patches are managed across internet-facing systems. Chubb asks whether any software or hardware retired by the manufacturer is in use.
Other controls. Applications may also ask about firewalls, email filtering, logging and monitoring, penetration testing, password requirements, and removing access when employees leave.

Backups and recovery

The Travelers application asks whether backup and recovery procedures cover all important business and customer data, whether they’re automated, and whether they’re tested annually. It also asks how long it takes to restore critical operations after an interruption, based on testing, with “Unknown” as an option.
Beazley asks how often business-critical data is backed up.
Chubb, for business interruption coverage, asks whether backup and recovery procedures are implemented, documented and tested at least annually for mission-critical systems.

Separately from any insurer’s questions, it helps to ask your IT contact how backups are made, whether they are separated from your everyday systems, who can access or delete them, and when a restore was last tested.

People, procedures and payments

Training. Beazley asks how often interactive phishing training is conducted. Travelers asks about annual privacy and security training.
Incident response. Travelers and Chubb ask whether you have an incident response plan, and Travelers also asks about disaster recovery or business continuity plans and whether they’re tested. Beazley asks about an incident response plan in its additional-controls section for applicants with revenues greater than $35 million.
Vendors. Travelers asks whether vendors with system access are covered by written security requirements, access reviews, prompt revocation, logging, insurance requirements and indemnity clauses.
Payment verification. Beazley asks whether changes to a vendor’s bank details are confirmed through a different channel than the request, and whether staff who send funds receive anti-fraud training. Chubb, for cyber crime coverage, asks about callback authentication, dual approval for wire transfers and verifying vendor bank accounts. For how these losses can overlap with crime insurance, see our commercial crime insurance guide.

Prior incidents, claims and known circumstances

Each application defines what to report, and over what period:

Travelers asks about the past three years. It covers system disruptions from an attack or system failure, actual or suspected breaches, extortion demands, and certain complaints, claims or litigation. It also asks whether anyone proposed for coverage knows of a circumstance that could give rise to a claim.
Beazley asks about the past five years. It covers privacy and security claims or complaints, government actions, breach notifications and extortion demands (including ransomware), with follow-up questions about the number and size of events. It also asks about knowledge of facts that may give rise to a claim, loss or breach-notification obligation.
Chubb asks about the past three years for actual or potential incidents or claims, and about known circumstances, including the date, any amount paid or reserved, and the current status.

Answer using each application’s own wording and time period. Disclosing something on a new application is separate from giving notice under a policy you already have. If something may need to be reported under a current policy, follow that policy’s notice requirements. Don’t rely on a new application to do that.

Existing insurance

The reviewed Travelers application asks whether the applicant currently purchases CyberRisk coverage and requests the expiring carrier, limit and date coverage was first purchased.
Chubb asks whether you currently buy errors and omissions, cyber or privacy liability, or media liability insurance, and the retroactive date for each.

Have your current declarations pages ready, including limits, retentions, policy dates and any retroactive dates. Gather any crime, technology errors and omissions, or professional liability policies too, so they can be reviewed alongside cyber. For how claims-made timing works, see our guide to claims-made policies, retroactive dates and tail coverage.

Coverage you want quoted

Applications list coverages you can request. Not every policy includes every coverage.

The Travelers application lists insuring agreements with requested limits and retentions, including privacy and security liability, regulatory proceedings, breach notification, computer and legal experts, cyber extortion, data restoration, computer fraud, funds transfer fraud, social engineering fraud, business interruption and dependent business interruption.
The Chubb short form lists desired coverages with retentions and limits, including incident response, business interruption and contingent business interruption (each with a waiting period), digital data recovery, network extortion, cyber privacy and network security liability, and cyber crime.

Think about which of these matter to your business, and ask what each one requires.

Supporting documents

The Travelers application asks for details of any reported incident or claim. It asks for a description of compliance steps if a GDPR question is answered a certain way, and a separate supplement if a particular optional coverage is requested. It also says the insurer may obtain information from public sources, including the internet.
The Travelers MFA supplement is a separate form. It asks whether the signer completed it with the help of the person in charge of IT security.

Other documents, such as security questionnaires, scans or policies, may be requested later in underwriting. Provide only what the insurer actually asks for.

Getting the answers right

Have your IT contact verify technical answers. The Travelers MFA supplement asks whether the signer completed it with help from the person in charge of IT security.
Separate what’s in place from what’s planned. Answer based on controls operating now, and describe planned improvements separately if the application allows.
Read the definitions and signature statements. The Travelers application asks the authorized representative to represent that, after reasonable inquiry, the answers are true and complete. Beazley says responses should be accurate as of the date the application is signed.
Ask about partial or unclear answers. If a control covers only some users or systems, has exceptions, is handled by an outside provider, or you don’t know the answer, ask how to answer. Use the application’s space for explanations.
Report changes before coverage begins. Beazley asks the applicant to notify the insurer immediately if information changes between the application date and the effective date, and says outstanding quotations may be withdrawn or modified. Chubb has a similar material-change provision.

How an inaccurate answer affects coverage depends on the policy, the facts and applicable law. If you have questions about the legal effect of an application statement, ask an attorney.

Information, preparation and questions

Information	What to prepare	What to clarify
Business identity	Legal name, DBAs, related companies, website, industry, revenue, employee count	Which entities should be included?
Data handled	Types of personal, health and payment information; an estimate of individuals or records	How does this application define the count?
Technology and vendors	Key systems, cloud services, outsourced IT, payment processor	Which providers would stop operations if unavailable?
Security controls	MFA, endpoint protection, patching, email security	How do I answer partial deployment or outsourced controls? Which questions apply to my business size?
Backups and recovery	Backup frequency, separation, testing, restore time	What does the application mean by tested or separate backups?
Payments	How bank-detail changes and wire transfers are verified	Which cyber crime or crime coverages fit?
Prior incidents	Incidents, claims, extortion demands, known circumstances	What period and definitions apply? Does a current policy need separate notice?
Existing insurance	Declarations, limits, retentions, retroactive dates	How do cyber, crime and professional liability fit together?
Coverage wanted	Coverage parts, limits and retentions to quote	Which coverages, waiting periods and sublimits apply?

A staged checklist

Initial discussion

Business name, entities, industry, revenue and employees
Types of data handled and a rough count
Key systems and providers
Current cyber, crime and professional liability policies
Coverages you want to discuss

Application completion

Security control answers, verified by your IT contact
Backup and recovery details
Training, incident response and vendor practices
Payment verification procedures
Prior incidents and known circumstances, using the application’s definitions and periods
A review of definitions, representations and signature statements before signing

Further underwriting, if requested

Any supplements, such as an MFA supplement
Explanations for “no” or partial answers
Additional documents the insurer specifically requests
Notice of any changes before coverage begins

Questions to ask your IT provider

These are preparation questions for your own business, not any insurer’s requirements:

Is MFA required for email, remote access and administrator accounts, and are there any exceptions?
What endpoint protection is installed, and on which devices?
How are patches applied, and are any systems out of support?
How are backups made, separated and protected, and when was a restore last tested?
Which outside services would stop our operations if they went down?

Keep sensitive information protected

Don’t send passwords, recovery codes, credentials, customer records, detailed system configurations or sensitive security documents through a website form or ordinary email. Ask what’s actually needed, and arrange an appropriate secure way to provide it.

Requesting a quote doesn’t bind coverage

Asking for a quote or completing an application doesn’t put coverage in place. Beazley’s application, for example, states that signing it “does not bind the applicant or the insurer to complete the insurance.” Ask your agent to confirm whether coverage has been bound, its effective date and the agreed terms.

Sources

Travelers, CyberRisk Applications and Forms
Travelers, CyberRisk Application, CYB-14102 Ed. 01-19. Illustrative; not confirmed current Texas requirements.
Travelers, Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23. Illustrative.
Beazley Insurance Company, Inc., Cyber Insurance Application (revenues lower than $250M), F00863 04/2023 ed.. Illustrative.
Chubb (ACE American Insurance Company), Cyber ERM Cyber and Privacy Insurance Short Form Application, PF-48163 (10/16). Illustrative 2016 edition.

About Melliand Insurance Agency

Melliand Insurance Agency is an independently operated insurance agency affiliated with Premier Group Insurance (PGI), a nationwide agency network.

If you’d like help preparing for a cyber insurance quote, call (972) 346-4666 or email melliandinsurance@gmail.com, Monday–Friday, 8 AM–5 PM Central.

This article provides general information only. It is not legal or technical advice and is not a statement of coverage. Application questions, eligibility and coverage vary by insurer and policy. The applications described here are illustrative examples identified by form and edition and are not confirmed current Texas requirements. Requesting a quote or completing an application does not bind coverage.