CYBER LIABILITY SUPPLEMENTAL APPLICATION - Section I - Introduction - Network Security & Data Privacy

Sep 4, 2026

Uploaded by Sage

Cyber Liability Supplemental Application gathers applicant information and answers focused on network security and data privacy controls. It requests details on internal training, incident reporting procedures, document and internet/email use, password practices, and responsibility for company data. The form also covers cyber competency testing, account access termination, privacy policy review, incident response and ransomware business continuity mitigation. Additional sections request compliance with HIPAA, HITECH, PCI DSS and SOC/Biometric requirements, plus audits, server and network structure, monitoring, patching, vulnerability correction, and security controls such as EDR, segmentation, MFA, encryption, and privileged account management.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages8

Reading Time20 min

AccessFree to download

SECTION I – INTRODUCTION

Applicant information

Network security & data privacy overview

SECTION II - NETWORK SECURITY & DATA PRIVACY

Part 1 – Internal training, policies and procedures

Part 2 – Network security and data privacy controls

Compliance and audit assessments

Security controls and operational procedures

CYBER LIABILITY SUPPLEMENTAL APPLICATION SECTION I – INTRODUCTION 1. Full Name of Applicant: (Include all prior names, DBAs and subsidiaries seeking coverage under the policy for which you are applying) 2. Website Address(es): 3. Have you experienced any mergers, acquisitions, or divestitures in the last 5 years? Yes No Do you plan on any within the next 12 months? Yes No If Yes to either of the above, provide complete details: SECTION II -NETWORK SECURITY & DATA PRIVACY PART 1 – INTERNAL TRAINING, POLICIES AND PROCEDURES 4. Do you conduct employee training on an annual basis (or more frequently) related to: a. HIPAA Compliance Yes No b. Company Incident Reporting Procedures Yes No c. Document Management Yes No d. Internet and Email Use Yes No e. Passwords Yes No f. Responsibility for Company Data Yes No 5. Do you conduct cyber competency testing on an annual basis (or more frequently) for employees and contractors on: a. Social engineering attacks ([i.e. email-based](i.e. email-based) phishing, baiting, scareware, etc. ) Yes No b. Physical security (locked and secured computer devices) Yes No 6. Do you use any of the following technology: a. Meta Pixel or similar technology on your website Yes No b. Session Replay or similar technology Yes No c. Chatbot or similar technology Yes No If Yes to any of the above, do you request affirmative consent from users? Yes No If No, describe below: 7. Do you have rapid (immediate) account access termination procedures for employees that leave the company? Yes No 8. Do you have a privacy policy? Yes No If Yes, has it been reviewed by legal representation? Yes No 9. Do you maintain an incident response plan which includes business continuity mitigation procedures in the event of a ransomware threat? Yes No 10. a. Are you compliant with the following: | | Indicate N/A, Yes or No | Date of Last Audit/Assessment | | --- | --- | --- | | Health Information Portability and Accountability Act (HIPAA) | N/A Yes No | | | Health Information Technology for Economic and Clinical Health Act (HITECH) | N/A Yes No | | | Payment Card Industry Data Security Standards (PCI DSS) | N/A Yes No | | b. If you are subject to PCI DSS, what is your certification level? c. Complete the chart below for any of the following assessments you have completed: | | Indicate N/A, Yes or No | Date of Last Audit/Assessment | | --- | --- | --- | | SOC II Certification Type I | N/A Yes No | | | SOC II Certification Type II | N/A Yes No | | | Biometric Information Privacy Act (BIPA) | N/A Yes No | | d. Describe any changes made to operations, procedures and/or network security and data privacy practices asa result of the recent Audits/Assessments listed in the two charts above: PART 2 – NETWORK SECURITY AND DATA PRIVACY CONTROLS 11. a. Where do your servers reside? Cloud On Premises b. If cloud, which vendor(s) do you use? c. Are your production servers separated in different locations? Yes No 12. a. Is your network managed in-house or by a vendor? b. If outsourced, which vendor(s) do you use? c. What are the qualifications of your IT security leaders? (Examples: CISSP, CISM, CISA, CEH, CCSP) 13. Indicate all IT risk management elements implemented: | | In-House | Vendor | | In-House | Vendor | | --- | --- | --- | --- | --- | --- | | Access Restrictions | | | Hot Site | | | | Anti-Virus Scanning | | | Load Balancers | | | | Automated Security Scanning | | | Proxy Servers | | | | Network Intrusion Detection | | | Security Audits | | | | Encryption | | | Secure Remote Capabilities | | | | Firewall | | | Other: | | | 14. What types of network monitoring solutions (active and passive) do you have in place, and who does the monitoring? 15. How frequently do you test your network security to ensure effectiveness and response time? Monthly Quarterly Annually 16. What are your procedures for correcting vulnera

FAQs

What applicant details are required in Section I?

Section I requests the full legal name of the applicant and any prior names, DBAs, or subsidiaries, plus website address(es). It also asks whether the applicant experienced mergers, acquisitions, or divestitures in the last 5 years and planned any in the next 12 months.

What internal training and policy areas must be covered annually?

The form asks whether employee training occurs annually (or more frequently) for HIPAA compliance, incident reporting procedures, document management, internet and email use, password practices, and responsibility for company data.

Which security and privacy controls are evaluated in Part 2?

Part 2 evaluates server hosting (cloud vs on premises), network management, qualifications of IT security leaders, implemented IT risk management elements, monitoring coverage, security testing frequency, penetration-test remediation, patching practices, zero-day response, EDR and segmentation, MFA coverage, privileged account controls, proxy/outbound request filtering, and external email tagging.

Sep 4, 2026

Uploaded by Sage