Understand what cyber underwriters really need in IR plans. Learn why testing matters and what documentation to prepare for renewals.
When underwriters ask 'Do you have an incident response plan?', they are distinguishing between three levels of readiness: having a document (lowest), maintaining current documentation (middle), and actively testing the plan (highest). The cost of a data breach for companies without a tested IR plan is 55% higher than for those with one, which explains why underwriters prioritize proof of testing. Underwriters ask specifically for: a written incident response plan documenting roles, responsibilities, communication procedures, and escalation paths; evidence that the plan has been tested through tabletop exercises or simulations within the past 12 months; proof that the plan is current and reflects actual organizational structure and contact information. A document created two years ago without testing is insufficient. Underwriters rank incident response planning among effective controls associated with lower breach probability, alongside EDR and logging/monitoring. The key distinction is that brokers must provide proof of recent testing, not just the existence of a plan document.
Cyber application asks 'Do you have an IR plan?'; client says 'yes'; broker receives PDF from IT; broker forwards to underwriter; underwriter asks 'When was it last tested?'; if untested, contingency issued or application rejected.
Application language doesn't clarify that testing is required; brokers often unaware of testing requirement; clients may have plans but no test documentation; no standardized format for test results.
Structured IR plan attestation showing: plan creation/update date, roles and participants, test date and type (tabletop/simulation), test findings summary, and proof of plan distribution to team. Template for IR plan testing checklist.
Use Evidence Room
Use Evidence Room →“Underwriters want evidence of regular tabletop exercises and a clear, actionable plan for the first few hours of a breach.”
“The cost of a data breach for companies without a tested IR plan is 55% higher, explaining underwriter prioritization.”
“Incident response planning ranks among effective controls associated with lower breach-based claim probability.”