Your insurer requires measures: where to start
At renewal - or when you take out a cyber policy - the insurer requires measures: written policies, authentication, backups, training. It is not the law speaking, it is the contract - but the consequences are just as real.
What happens
Insurers increasingly tie the premium, the deductible or the coverage itself to verifiable measures. The real risk is not the question on the form: it is the claim refused later because a declared measure was not actually in place. An inaccurate declaration to the insurer is the classic ground for refusal.
How to respond
- Read exactly what is required - “written security policy” and “access management program” are not the same thing; answer to the letter.
- Provide dated documents - the insurer assesses the measure AND its record; a document dated before the loss is the one that pays out.
- Go through your broker - to interpret the requirements, negotiate the deadlines and confirm what is enough: it is their role, and they do it at no cost to you.
- Declare only what is in place - and for the rest, state the planned implementation date. An insurer prefers an honest timetable to a box ticked in advance.
The overlap with the law
Good news: many insurer requirements overlap with obligations you already have. Law 25 requires security measures suited to protecting personal information (P-39.1, s. 10), a privacy policy and a designated person in charge; occupational health and safety requires its written program or action plan. Your compliance documents serve twice: they answer the law AND the insurer's questionnaire.
Where to start: the free assessment lists your obligations and their documents - dated, in your name. Most insurer requirements find their document there. And in the event of an incident involving personal information, notifying your insurer is a requirement of the contract: the procedure is here (in French).