What Is a Cyber Insurance Attestation? The Signature That Can Void Your Policy

Denial Versus Rescission: The Distinction That Matters

Most coverage discussions blur these together. They are different events with different balance sheet consequences.

Denial means the insurer declines a specific claim, usually because the loss falls outside coverage, hits an exclusion, or breaches a condition. The policy survives. Other claims may still be paid.

Rescission means the insurer seeks to void the policy from inception on the grounds that it was procured through material misrepresentation. If successful, the contract is treated as though it never formed. Premium is typically returned. Any claims previously paid under it may be recoverable by the insurer. There is no coverage for the pending event, and there was never coverage for anything else.

An inaccurate attestation is a rescission argument, not a denial argument, because it goes to the formation of the contract rather than to the scope of coverage. That is why it is categorically more dangerous than the coverage disputes organizations usually plan for.

The Materiality Test

Insurers do not get rescission for any inaccuracy. The general standard, which varies by jurisdiction and by policy language, is materiality: would the insurer have declined the risk, or written it on different terms or at a different price, had it known the truth?

That test is why control questions are worded the way they are. When a carrier asks specifically about MFA on remote access, on email, and on privileged accounts as three separate questions, it is establishing that each answer independently influenced underwriting. It is building the materiality record in advance.

Does Good Faith Save You?

This is the question General Counsel ask and the internet does not answer. The uncomfortable position: in many jurisdictions, a material misrepresentation can support rescission regardless of intent. The signer genuinely believing the answer was true does not necessarily preserve the contract, because the insurer's reliance was the same either way.

Intent matters enormously for a different question, which is whether the conduct crosses from civil misrepresentation into insurance fraud. Knowingly false statements made to procure insurance are criminal in most states. The overwhelming majority of inaccurate attestations are not fraud. They are organizational failures: the person who answered did not know, the control was partially deployed, or it was true when signed and quietly stopped being true.

Jurisdiction and policy wording drive the analysis, and this is not legal advice. The practical takeaway is that good faith is a thin defense and a poor plan.

What the Litigation Shows

Two cases are worth knowing by name, because they define the shape of the risk.

Travelers Property Casualty Company of America v. International Control Services, Inc. (2022, Central District of Illinois). Travelers issued a cyber policy after the insured represented on its application that it used multi-factor authentication. Following a ransomware incident, Travelers alleged MFA was not in place as represented and sued to rescind the policy rather than to deny the claim. The matter resolved with the parties agreeing to rescission.

The significance is not the dollar amount. It is that the carrier went straight to rescission over a single control representation, and the insured ended up with no policy rather than an arguable claim.

Columbia Casualty Co. v. Cottage Health System (2015, Central District of California). After a data exposure and a resulting class action settlement, the insurer sought to avoid its obligations, citing the application's representations about the insured's security practices and a policy provision requiring maintenance of minimum required practices. The procedural history is tangled, the initial filing was dismissed on an alternative dispute resolution technicality, but the argument was the one that matters: the controls you said you maintained are a condition of the coverage you bought.

Read together, the cases establish that carriers treat control representations as underwriting foundations and are willing to litigate to unwind policies procured on inaccurate ones.

The "MFA Everywhere" Problem

Every attestation asks about multi-factor authentication. Almost none define it adequately, and this is where accurate-sounding answers go wrong.

Consider what "MFA is enabled on all remote access" has to survive:

• Legacy systems that cannot support it. An ERP from 2009, an OT segment, a clinical system whose vendor will not certify a modern identity provider. These exist in nearly every mid-market estate.
• Service accounts. Non-human identities that run integrations and scheduled jobs. Frequently excluded from MFA by necessity, frequently over-privileged, and frequently the path an attacker takes. Are they in scope of the question? The form rarely says.
• Break-glass accounts. Emergency administrative credentials deliberately exempted from conditional access so that a failure of the identity provider does not lock you out entirely. Legitimate, and an exception.
• API keys and tokens. Not covered by MFA in any meaningful sense, and an increasingly common initial access vector.
• Exception lists. The executive who found MFA disruptive and was granted an exemption that nobody revisited.

The honest answer for most organizations is "MFA is enforced on remote access with the following documented exceptions." Whether the form permits that nuance varies. Where it does not, the right move is to attach the exception list rather than to round the answer up to yes. An insurer that accepts the risk with disclosed exceptions has underwritten what actually exists. An insurer that discovers undisclosed exceptions after a loss has a rescission argument.

Point-in-Time Signature, Continuous Coverage

You attest on one day. The policy runs for a year. Controls drift.

An MFA exemption granted in month seven for a project deadline. An EDR agent that stopped reporting on a subset of endpoints. A backup job silently failing since a storage migration. A privileged access tool deployed in pilot and never completed.

Does a control that lapses mid-term impair the policy? It depends on what the policy requires. Some carry ongoing conditions requiring maintenance of the represented controls, which converts drift into a coverage condition rather than a representation issue. Others do not, leaving the representation as a point-in-time statement. Read your own policy for the distinction, and know whether you have a duty to notify the carrier of material changes mid-term.

The operational answer is the same either way: the attestation should be backed by continuous monitoring, not by an annual scramble. If you cannot demonstrate that a control operated throughout the policy period, you will struggle to defend it after a loss.

Who Signs, and What They Are Exposed To

This is absent from every ranking article on the subject, which is remarkable, because it is the first question anyone should ask before putting their name on the form.

The attestation is typically signed by a named officer. In practice this lands on the CFO, sometimes the General Counsel, sometimes a CISO, and occasionally on whoever was available when the broker needed it back.

What the signer should understand:

• It is a representation by the organization, made by a person. The signature carries the organization's word, and the individual is identified with it.
• The information problem is structural. The CFO who signs rarely has direct knowledge of the control state. The CISO who has the knowledge frequently does not sign. If the CISO tells the CFO "we have MFA" and the CFO signs, the misstatement is the organization's, but the internal accountability is genuinely contested, and it will be examined after a loss.
• Directors and officers exposure is not a clean backstop. If a rescinded cyber policy leads to shareholder or stakeholder claims against leadership, the D&O tower becomes relevant. D&O policies have their own application representations, and an organization careless with one set of representations may not have been careful with the other.

The governance fix is straightforward and almost never implemented: each answer on the attestation should have a named owner who provides evidence, the evidence should be retained with the signed form, and the signing officer should be attesting to a documented package rather than to a conversation.

Evidence: What Actually Defends the Attestation

If a carrier challenges a representation after a loss, the question becomes what you can prove about the control state on the day you signed.

A defensible package, assembled at signing rather than reconstructed afterward:

• Configuration exports from the identity provider showing conditional access policies, MFA enforcement scope, and the exception list, dated.
• EDR deployment reports showing agent coverage as a percentage of known assets, with the gap explained. Coverage is the number carriers care about, and it is almost never 100 percent.
• Backup test records. Not backup success logs, restore test records. The question is whether you restored, not whether the job completed.
• Privileged access inventory showing which accounts are privileged and what governs them.
• A dated third-party assessment where one exists. Independent verification is materially stronger evidence than internal assertion.
• The exception register, with business justification and review dates.

The discipline this produces has value beyond insurance. An organization that can evidence every control assertion on an insurance form can answer a customer security questionnaire, a regulator, and an acquirer's diligence request from the same package.

Vendor Attestations Flow Both Directions

Two separate exposures, and organizations usually think about neither.

Attestations you receive. Your contracts likely require vendors to maintain specific controls and to carry cyber insurance with you as additional insured. If a vendor's attestation to its own carrier was inaccurate and its policy is rescinded, the insurance you were relying on as a backstop for that vendor's failure does not exist. Your contractual remedy is then against a company that just suffered an uninsured loss.

Attestations you give. When an enterprise customer requires you to attest to controls, you have created a representation running to them. An inaccuracy there is a contractual matter with a party who has commercial leverage over you, and potentially a claim their insurer will pursue through subrogation.

The M&A Exposure

This is absent from the entire published landscape and it is the highest-value question for a sponsor or corporate acquirer.

Does the Target's Attestation Survive the Close?

Generally the acquirer's own policy will not extend to a newly acquired entity on the basis of the target's representations, and most cyber policies contain change of control provisions and newly acquired entity clauses with thresholds and notice requirements. The target's attestation was made to the target's carrier about the target's environment. It does not transfer to you as assurance.

The practical sequence after close is that the acquired entity either continues under a runoff of its own policy, is added to the acquirer's program subject to the acquirer's underwriting, or falls into a gap while that is negotiated. That gap is real and it is frequently unmanaged.

Who Eats a Rescission Discovered Post-Close?

Consider the scenario: a portfolio company suffers an incident eighteen months after close. The carrier investigates, determines that the attestation signed before the acquisition materially misrepresented control state, and seeks rescission.

Where the loss lands depends on what was negotiated. Compliance representations in the purchase agreement may capture it. An indemnity may apply if the misrepresentation was pre-close and known. Representations and warranties insurance may respond, or may not: R&W underwriters exclude known issues disclosed in diligence, so an attestation problem identified during diligence and disclosed is typically carved out, while one nobody looked for becomes a coverage dispute layered on top of the original loss.

The reason this is worth pricing pre-close is that the underlying failure predates you, the consequence lands on you, and the recovery path is uncertain.

What Diligence Should Actually Request

Not just the certificate of insurance. Request:

• The signed attestation or application for the current policy period, and the two prior.
• The evidence supporting each control assertion. If the target cannot produce it, the representation was an assertion, not a verified fact.
• The exception register for the controls attested to.
• Policy terms on change of control and newly acquired entities.
• Any prior claims and how the carrier responded, including reservation of rights letters, which tell you what the carrier was already skeptical about.

A target that signed an attestation it cannot evidence has an insurance program that may not respond. That is a finding with a number attached to it, and it belongs in the model.

Related Reading

• What is Cyber Insurance?
• What is Multi-Factor Authentication?
• What is Phishing-Resistant MFA?
• RTO and RPO: What the Numbers Commit You To
• What is Third-Party Risk Management?
• What is M&A Cyber Due Diligence?

Frequently Asked Questions

What is a cyber insurance attestation?

A statement signed by an officer of an organization certifying to an insurer that specific security controls are in place. Typical control questions cover multi-factor authentication on remote access and privileged accounts, endpoint detection and response coverage, immutable or offline backups with restore testing, privileged access management, email filtering, and security awareness training. The insurer prices and issues the policy in reliance on those answers, which is what gives them legal weight.

What happens if a cyber insurance attestation is inaccurate?

The exposure is rescission rather than simple claim denial. Denial declines a specific claim and leaves the policy intact. Rescission voids the policy from inception on the grounds it was procured by material misrepresentation: premium is typically returned, previously paid claims may be recoverable by the insurer, and there is no coverage for the pending loss. Because an inaccurate attestation goes to contract formation rather than coverage scope, it is categorically more dangerous than the coverage disputes most organizations plan for.

Can an insurer void a policy over a wrong answer made in good faith?

Potentially. In many jurisdictions a material misrepresentation can support rescission regardless of the signer's intent, because the insurer's reliance was the same either way. Materiality generally turns on whether the insurer would have declined the risk or written it on different terms had it known the truth. Intent matters primarily for whether conduct crosses into insurance fraud, which is criminal in most states. Outcomes depend on jurisdiction and policy wording, and this is a question for coverage counsel rather than a matter of general rule.

Has an insurer actually rescinded a cyber policy over MFA?

Yes. In Travelers Property Casualty Company of America v. International Control Services (2022, Central District of Illinois), Travelers sued to rescind a cyber policy after a ransomware incident, alleging the insured had represented on its application that it used multi-factor authentication when it did not. The matter resolved with the parties agreeing to rescission. Columbia Casualty Co. v. Cottage Health System (2015) raised a related argument about an insured's representations regarding its security practices and a policy condition requiring maintenance of minimum required practices.

What does MFA everywhere actually mean on an attestation?

This is where accurate-sounding answers most often go wrong. Nearly every estate contains legitimate exceptions: legacy systems that cannot support modern authentication, service accounts running integrations, break-glass emergency credentials deliberately exempted from conditional access, API keys and tokens not covered by MFA in any meaningful sense, and individual exemptions granted during rollout that were never revisited. The defensible answer for most organizations is that MFA is enforced with documented exceptions, attached. Rounding the answer up to an unqualified yes is what creates the rescission argument.

What if a control lapses after we sign?

It depends on the policy. Some cyber policies include ongoing conditions requiring maintenance of the represented controls, which converts mid-term drift into a coverage condition. Others treat the attestation as a point-in-time representation. Read your policy for the distinction and determine whether you have a duty to notify the carrier of material changes mid-term. Operationally the answer is the same either way: back the attestation with continuous monitoring, because if you cannot demonstrate a control operated throughout the policy period you will struggle to defend it after a loss.

Who should sign the attestation?

An officer who is attesting to a documented evidence package rather than to a conversation. The structural problem is that the person who signs, usually the CFO, rarely has direct knowledge of control state, while the person with the knowledge often does not sign. The governance fix is to assign each answer a named owner who supplies dated evidence, retain that evidence with the signed form, and have the signing officer review the package. This is rarely done and it is the single highest-value control around the attestation process.

Does a target's cyber insurance attestation survive an acquisition?

It does not transfer to the acquirer as assurance. The attestation was made to the target's carrier about the target's environment, and most cyber policies contain change of control provisions and newly acquired entity clauses with thresholds and notice requirements. After close the acquired entity typically continues under runoff, is added to the acquirer's program subject to fresh underwriting, or falls into an unmanaged gap. Diligence should request the signed attestation for the current and two prior periods, the evidence behind each control assertion, the exception register, and any prior claims correspondence including reservation of rights letters.

The Gap Between the Form and the Estate

The pattern Cloudskope encounters most often in assessment work is not deception. It is distance.

An attestation asks whether multi-factor authentication is enforced on all remote access. Someone in IT is asked. The answer is yes, and it is offered in good faith, because MFA was deployed, there was a project, it closed, and the dashboard shows it enabled.

What the dashboard shows is that the policy exists. What it does not show without deliberate investigation is the exclusion group created during rollout for the systems that broke, which still has members. Or the legacy authentication protocol left enabled for a mail client nobody has audited. Or the service accounts running integrations, outside the policy scope by design. Or the executive exemption granted during a travel week in a prior year.

Every one of those is individually defensible. Collectively they mean the sentence on the form, MFA is enforced on all remote access, is not accurate, and the person who signed it has no idea.

The distance runs the other way too. The officer signing has no mechanism to verify the answer independently. They are relying on a report from a team reporting on its own work. That is not a character problem. It is a control design problem, and it is exactly the structure that produces a rescission argument two years later.

The organizations that close this gap do one unglamorous thing: they require evidence for every answer before the form is signed, and they keep it. The evidence-gathering exercise is also where the exceptions surface, which means the attestation becomes accurate before it is signed rather than contested after a loss.