Renewal questionnaires have tightened every cycle, and for healthcare the pattern is consistent. Expect to attest to:
- MFA everywhere that matters: email, remote access, and administrative accounts. Partial MFA ("most users") increasingly reads as no.
- EDR on endpoints, monitored. Carriers now ask for endpoint detection and response by name, and many ask who watches it around the clock. Our EDR vs antivirus guide explains the difference the question is probing.
- Backups that are tested and separated. Not "we have backups" but offline or immutable copies, restore tests, and recovery time estimates.
- Security awareness training and phishing testing with records.
- Patching cadence, email filtering, and no end-of-life systems facing the internet.
Two renewal truths worth more than any single control. First, the application is a warranty: answering yes to a control you do not actually run is how claims get denied after an incident, which is worse than a higher premium. Second, carriers price the controls, so closing the MFA and EDR gaps before renewal routinely pays for itself in premium, not just risk.
The full questionnaire walk-through lives in our cyber insurance requirements guide.