Cyber Insurance Evidence Glossary

Cyber insurance evidence

Documentation, exports, logs, or attestations that demonstrate a security control is in place and operating. Evidence can be auto-verified (e.g., DNS records) or manually collected (e.g., MFA enrollment reports).

Control evidence

Proof that a specific security control is implemented and active. Different from a policy document, which describes intent. Control evidence shows the control is actually working.

Attestation

A formal statement by a responsible party (usually the insured or an authorized representative) confirming that a control is in place. Attestations are used when automated verification is not possible.

Carrier supplement

A questionnaire or additional form issued by an insurance carrier as part of the application or renewal process. Supplements contain questions about specific security controls and require evidence or attestation in response.

See also: Carrier decoder

Renewal intake

The process of receiving, reading, and triaging a carrier renewal notice. Includes extracting deadlines, identifying required supplements, and routing questions to responsible parties.

See also: Renewal email parser

Readiness check

An assessment of an organization's cyber insurance readiness based on observable security controls. BindLedger's free readiness check evaluates controls visible from public infrastructure (DNS, TLS, exposed services) and maps findings to carrier expectations.

See also: Run a free readiness check

Outside-in verification

Security assessment performed using only publicly observable data — DNS records, certificate transparency logs, TLS configuration, HTTP headers, and internet-facing services. Does not require authentication or tenant access.

Tenant-level evidence

Evidence that requires authenticated access to internal systems. Examples: MFA enrollment reports from Okta or Entra ID, EDR deployment coverage from CrowdStrike, backup configuration exports from Veeam. Cannot be verified from outside.

Evidence freshness

How recently evidence was collected or verified. Carriers increasingly expect evidence to be current (within 30–90 days of submission). Stale evidence may not satisfy underwriting requirements even if the underlying control hasn't changed.

See also: Evidence guides

Evidence provenance

The chain of custody and source of a piece of evidence. Includes when it was collected, from which system, by whom, and whether it was auto-exported or manually assembled.

See also: Evidence guides

Carrier-mapped readiness

The practice of aligning security findings and evidence to specific carrier questionnaire requirements. BindLedger normalizes questionnaire items into control-level evidence requirements so findings and evidence can transfer across carriers.

Remediation blocker

A finding that is likely to prevent policy issuance, cause a coverage exclusion, or trigger additional underwriting scrutiny. Common blockers include missing DMARC enforcement, publicly accessible RDP, and absent MFA.

Straight-through renewal

A renewal that proceeds without additional underwriting questions, supplemental requests, or evidence demands. Requires clean readiness posture and complete evidence documentation.

Client attestation

A statement from the insured organization (not the broker or MSP) confirming a control is in place. Required for controls that cannot be verified through technical exports or outside-in scanning.

MSP evidence

Technical exports or reports provided by a managed service provider demonstrating that security controls are deployed and operating in a client environment. Examples: EDR coverage reports, MFA enrollment summaries, patch compliance dashboards.

See also: Evidence collection guides

Broker review

The process by which an insurance broker reviews collected evidence, attestations, and readiness findings before submitting an application or renewal to the carrier.

See also: Underwriting answers

Submission packet

A compiled set of evidence, attestations, readiness findings, and carrier-mapped documentation assembled for submission alongside a cyber insurance application or renewal. Not a replacement for the signed application itself.

See also: Generate an evidence packet

Rescission risk

The risk that an insurer voids a policy retroactively because material misrepresentations were made in the application. Inaccurate attestations or unsupported evidence claims increase rescission risk.

See also: Underwriting answers

Evidence packet

A structured collection of verified findings, collected evidence, open gaps, and carrier mappings assembled to support a cyber insurance submission. May include an executive summary, scan results, manual evidence checklist, and attestation references.

See also: Generate an evidence packet

Control taxonomy

A standardized classification system for security controls referenced in cyber insurance underwriting. Common categories include email authentication, MFA, EDR, backup and recovery, privileged access, incident response, and security awareness training.

See also: Carrier decoder and evidence guides