A cyber insurance renewal is often the first time a nonprofit’s leadership is forced to answer, in writing, whether the organization is actually protected. The questions are specific, the answers are signed, and the board that is ultimately responsible usually has never seen them.
The email arrives from the insurance broker on a Tuesday afternoon.
“Attached is your cyber renewal application. Please complete and return within ten days. An officer of the organization must sign.”
The executive director opens the attachment. It runs seven pages.
Do you require multifactor authentication for all remote access, email, and privileged accounts? Do you use endpoint detection and response on all devices, including servers? Are your backups offline or immutable, and when did you last test a restore? Do you have a written incident response plan? Do you verify changes to vendor payment details by phone? Have you had any security incident in the past two years?
She forwards it to the volunteer who handles IT. He replies, “I think we have most of that.” She asks the treasurer, who says to answer yes where we can and not to make it complicated, since last year’s premium was reasonable. She mentions it to the board chair, who has not heard the word “cyber” at a board meeting in three years.
Ten days is not long. The signature line has her name on it.
The Application Is a Legal Document, Not a Survey
It is tempting to treat renewal paperwork as an administrative chore. Insurance professionals say the opposite.
Carriers increasingly treat the application as a verification of specific controls, and many expect evidence behind each answer. More importantly, the answers become part of the contract. Material misrepresentation on a cyber insurance application can lead the insurer to rescind the policy, which means treating it as though it never existed, denying a claim, and in some cases seeking repayment of amounts already paid. According to commentators who advise on these disputes, some courts have allowed rescission even where the misrepresentation did not cause the loss. The outcome depends on state law and policy wording, so a broker or attorney should advise on how it applies to your policy.
The practical point is simple. Rounding “most of our accounts” up to “yes” is not harmless. If a ransomware attack comes through the account that did not have multifactor authentication, the answer on the application becomes the carrier’s first exhibit.
The honest alternative is not a disaster. Industry guidance consistently says that declaring a gap, with a realistic remediation date, is better than an answer that will not survive a forensic review. Carriers tend to reward honest gaps with a plan more than polished answers that collapse after a claim.
What Underwriters Are Actually Asking
Across carriers, the renewal questions have converged on a core set of controls.
Multifactor authentication. Not just “some MFA” but MFA on email, remote access, and privileged and administrator accounts, and increasingly on backups.
Endpoint detection and response. Modern monitored protection on every device and server, rather than legacy antivirus alone.
Backups. Copies that are offline or immutable, protected from the same credentials that run the network, and, critically, tested by actually restoring from them.
Email security and patching. Filtering for phishing and malicious attachments, and a process for applying security updates promptly.
A written incident response plan. A document that names who is called, who decides, and how the insurer’s breach team is engaged, ideally with a date showing it was reviewed or exercised.
Vendor and third-party risk. How the organization evaluates the companies that hold its data.
Funds transfer controls. Whether payment changes are verified through a callback to a known number, and whether large transfers need a second approver.
Training and prior incidents. Whether staff receive security awareness training, and whether any incident has occurred, including ones never formally reported. Advisers widely cite an omitted known incident as a cause of denied claims.
For a nonprofit, each question has a translation. “All users” includes volunteers, board members with organizational email accounts, and the part-time bookkeeper. “All devices” includes the donated laptops and the personal phones that read donor email. “Vendor risk” includes the donor database provider and the online giving platform.
The Coverage Question Matters as Much as the Controls
Meeting the underwriting requirements gets a nonprofit a policy. It does not guarantee the policy will pay for what actually goes wrong.
Funds transfer and social engineering fraud, which includes vendor impersonation and payment diversion, are commonly covered only up to a low sublimit, and some policies exclude business email compromise losses altogether. Advisers suggest comparing the cyber policy’s sublimit against a standalone crime policy if that scenario is a major concern. A cheaper policy with a small social engineering sublimit is a poor trade for an organization that wires grant funds or pays contractors.
A renewal conversation should cover the limits and retentions for ransomware, business interruption waiting periods, whether the policy pays for notifying donors and providing credit monitoring, whether it covers regulatory defense, and how it treats an incident that originates at a vendor, a scenario discussed in an earlier article in this series on donor database breaches.
Ask the broker plainly how the cyber policy fits with the organization’s directors and officers policy and its general liability and crime coverage. These policies are separate, and the boundaries between them are where gaps appear.
The Board Cannot Delegate Its Way Out of the Question
The executive director signs the application, but the board is responsible for the organization’s governance, and cybersecurity is now squarely part of it.
For Florida not-for-profit corporations, the statute setting the standard for directors was updated in the 2026 Florida Statutes. It requires directors to act in good faith and says that when becoming informed in connection with a decisionmaking function or devoting attention to an oversight function, board members must exercise the care that an ordinarily prudent person in a like position would reasonably believe appropriate under similar circumstances.
The same statute provides an important protection. Directors who do not have knowledge making reliance unwarranted may rely on information, opinions, reports, and statements prepared or presented by officers or employees they reasonably believe to be reliable and competent, and by counsel, accountants, or other experts on matters within their expertise.
Read together, those provisions point to a practical approach. The board is not expected to configure firewalls. It is expected to pay attention to the risk, receive credible reports from the people who manage it, and ask reasonable questions. A board that has never discussed cybersecurity has not used the oversight function the statute describes, and it has nothing to rely on if it is ever asked what it knew.
Counsel can explain how this applies to a particular organization. The direction of travel is clear regardless.
What the Frameworks Say Leadership Should Own
The federal frameworks make the same point in plain language.
The NIST Cybersecurity Framework 2.0 added a sixth core function, Govern, which establishes and monitors the organization’s cybersecurity risk management strategy, expectations, and policy. It includes a category for roles, responsibilities, and authorities that begins with the principle that organizational leadership is responsible and accountable for cybersecurity risk, and a category for oversight. NIST published a small business quick-start guide that it says can also help other relatively small organizations such as nonprofits, with a Govern section aimed at exactly this audience.
CISA’s Cyber Essentials is a free set of guidance for small organizations, with toolkits aimed at both IT staff and executive leadership. CISA’s Cross-Sector Cybersecurity Performance Goals, discussed in an earlier article in this series, provide a prioritized baseline that maps neatly onto the insurance questions above.
A board that works from these resources can build an oversight rhythm without hiring a security officer.
A Thirty-Minute Board Conversation
The first board discussion does not have to be technical. It should be structured and documented.
Ask management to present a one-page summary covering a handful of items: the share of accounts protected by multifactor authentication, the coverage of endpoint protection, the date of the last successful restore from backup, the date and owner of the incident response plan, a list of the vendors that hold donor or beneficiary data, the date of the last staff training, any incidents in the past two years, and the organization’s cyber insurance limits, sublimits, retentions, and renewal date.
Then ask five questions. What is the worst realistic scenario for us? What is our current exposure? Who would we call, and in what order, if we were attacked on Saturday night? What did the insurance application say, and can management show the evidence? And what do we need to fix in the next ninety days, and what will it cost?
Record the discussion in the minutes, along with the decisions. That record, combined with the management report, is what demonstrates that the board exercised oversight.
A Ninety-Day Renewal Plan
Renewal does not have to be a scramble. A simple timeline works.
Ninety days out. Gather last year’s application and supplemental questions. List every answer and assign an owner to verify each one.
Seventy-five days out. Test each answer against evidence: an MFA coverage report, an endpoint protection report, a backup restore log, the incident response plan, and the vendor list.
Sixty days out. Fix the highest-impact gaps, typically MFA on email and remote access, protection on servers, and a tested offline backup.
Forty-five days out. Hold a one-hour tabletop exercise with leadership using the incident response plan, so the document is not shelfware.
Thirty days out. Meet with the broker to review coverage options, sublimits, and how the organization’s honest answers affect pricing.
Fifteen days out. Present the application and evidence binder to the board or its finance committee for review before the officer signs.
At submission. The person who signs should have seen the evidence behind each answer.
Many nonprofits are surprised to discover that sixty days is enough time to close the most important gaps, and that a documented, tested position often improves both coverage terms and pricing.
If the Honest Answer Is “Not Yet”
Some answers will be no. That is common, and it is manageable.
Disclose the gap and describe a realistic plan with dates. Ask the broker how carriers treat the gap, since some will offer coverage with higher retentions or sublimits while the control is implemented. Avoid answers that are technically defensible but misleading, such as saying MFA is “enabled” when it is optional for most users.
Then do the work. An earlier article in this series described how funders and insurers are asking for documented evidence of security practices, and organizations that can provide it are in a stronger position on both fronts.
Name an Owner for the Evidence
The renewal is easier when someone owns it year-round, not for ten days in the fall.
Assign one person, such as the operations director or an outside managed IT services partner working with the executive director, to keep the evidence binder current. That owner exports the MFA and endpoint coverage reports each quarter, files the dated backup restore logs, updates the incident response plan when contacts change, and keeps the list of vendors that hold donor data.
When the broker’s email arrives, the application becomes a matter of copying from the binder, not reconstructing from memory. The same owner can prepare the one-page board summary, and cybersecurity monitoring supplies the ongoing evidence that controls are working, not just configured. That continuity is what insurers, funders, and auditors are really asking to see.
What This Means for Miami and South Florida Nonprofits
South Florida organizations face several local conditions that shape this conversation.
Hurricane season is a defining risk. Policies differ in how they treat business interruption and system downtime, and proof of offsite, tested backups matters as much to an underwriter as it does to the organization recovering from a storm.
Fundraising is event-driven. Galas, auctions, and relief campaigns create bursts of online giving through third-party platforms and large numbers of small payments, which increases both vendor exposure and fraud risk.
Many local nonprofits rely on volunteers and part-time or outsourced IT, which makes it harder to answer detailed control questions confidently. The solution is not a new hire. It is a documented view of what exists, produced by someone qualified to verify it.
Some funders ask for evidence of cyber coverage and basic controls in grant agreements, and Florida’s breach notification law applies to organizations holding Floridians’ personal information, so a donor data incident carries notification duties regardless of insurance.
Ask Your IT Provider Questions Like These
Can we produce current evidence for each control the application asks about, including MFA coverage by user, endpoint protection coverage by device, and a dated backup restore log?
Does our multifactor authentication cover volunteers and board members with organizational accounts, and does it cover remote access and administrator accounts?
Are our backups protected from the credentials that run our network, and when did we last restore from them?
Do we have a written incident response plan that names the insurer’s hotline, and have we walked through it?
Do we have a callback verification rule for changes to vendor and grant payment instructions?
Can you help management prepare the one-page report the board needs?
If your IT provider cannot answer these clearly, the answers on the application may be better described as hopes than facts.
The Signature Is Only as Good as the Evidence Behind It
A renewal application is an unusually honest moment. It asks, in plain words, whether the organization does what it says it does. For a nonprofit, the answers affect coverage, premiums, funder confidence, and the board’s own position.
The organizations that handle it well treat it as a prompt for governance, not paperwork: verify the answers, brief the board, fix the gaps, and document the work.
ITva Technologies provides managed IT and cybersecurity services for nonprofits across Miami-Dade and Broward, with specific experience preparing organizations for cyber insurance renewals and board-level oversight.
Our managed IT services include producing the evidence behind each application answer, from MFA and endpoint coverage reports to backup restore logs, and closing the gaps that matter most to underwriters.
Our cybersecurity services include incident response planning and tabletop exercises, vendor risk reviews, and a one-page board security summary built on the NIST Cybersecurity Framework.
Because many nonprofits run on Microsoft, our Microsoft 365 services also configure the multifactor authentication and email protections that underwriters check first.
If your organization has never walked its board through its cyber insurance application, that is worth doing before the next renewal email arrives.
Schedule a free cyber insurance readiness assessment with ITva.
We will compare your current controls against what carriers ask, assemble the evidence, and help you brief your board in thirty minutes.
Because the signature line has a name on it.
The evidence should be there before the pen is.
Frequently Asked Questions
Why do cyber insurance renewal applications matter so much?
The application is part of the contract. Material misrepresentation can allow an insurer to rescind the policy, which treats it as though it never existed, deny a claim, and in some cases seek repayment. Answers should be supported by evidence, and gaps should be disclosed with a remediation plan.
What controls do cyber insurers ask nonprofits about?
Common questions cover multifactor authentication on email, remote access, and privileged accounts, endpoint detection and response, offline or immutable and tested backups, email filtering and patching, a written incident response plan, vendor risk, funds transfer verification, staff training, and prior incidents.
What is a social engineering sublimit?
It is a cap on what a cyber policy will pay for fraud in which someone is tricked into sending money, such as vendor impersonation or payment diversion. These sublimits are often low, so organizations that wire grant funds or pay contractors should compare them with a standalone crime policy and discuss the options with their broker.
Is the board responsible for cybersecurity oversight?
Florida’s statute for not-for-profit directors requires good faith and ordinary prudent care when becoming informed for decisions or devoting attention to an oversight function, and allows directors to rely on reports from reliable officers, employees, and experts. A board that receives and questions a credible cybersecurity report is exercising oversight. Counsel can advise on how it applies to your organization.
What does NIST say about leadership and cybersecurity?
NIST’s Cybersecurity Framework 2.0 added a Govern function that makes organizational leadership responsible and accountable for cybersecurity risk and includes oversight. NIST also published a small business quick-start guide that can help other relatively small organizations such as nonprofits.
What if we cannot truthfully answer yes to a control question?
Disclose the gap and describe a realistic remediation plan with dates. Ask your broker how carriers treat the gap, since some offer coverage with higher retentions or sublimits while a control is implemented. Do not round an answer up to make the form look better.