Cyber insurance applications used to handle third-party risk with a single checkbox: do you rely on third-party vendors, yes or no. That question is gone. In its place is a section, and the section asks you to name vendors and produce evidence about their security posture rather than your own.
The change traces directly to claims experience. MOVEit and Change Healthcare demonstrated that a single compromised vendor can generate simultaneous losses across hundreds of insureds — precisely the correlated exposure that underwriting exists to avoid. Carriers responded by extending scrutiny past the perimeter of the organization they are insuring, into the organizations it depends on.
For a mid-market operator this changes what renewal preparation involves, and it introduces a risk most people underestimate: the application is a warranty, and answering it carelessly is worse than answering it badly.
What Underwriters Are Actually Asking
Expect a question structured roughly like this: list your top five software vendors with access to sensitive data, and confirm whether each provides a SOC 2 Type II report or equivalent attestation.
Three things about that question are worth parsing.
“Access to sensitive data” is broader than you think. It is not just the systems where customer records live. It includes your payroll provider, your email and productivity platform, your CRM, your backup provider, your MSP, and anything holding PHI, PII, or financial data. Operators consistently underestimate the list, usually by omitting tools bought outside IT.
“SOC 2 Type II” is a deliberate specification, not jargon. A Type I report attests that controls were suitably designed at a point in time. A Type II attests that they operated effectively over a period, typically six to twelve months. The difference is the difference between a photograph and a video. A vendor offering you a Type I when asked for a Type II is telling you something, and underwriters know it.
“Or equivalent” is doing real work. ISO 27001 certification is the common alternative, and for some vendors HITRUST or a FedRAMP authorization is stronger evidence than either. A vendor with no attestation of any kind is the finding that matters.
The practical bar is lower than it sounds. You are not expected to audit anyone’s security program. The carrier wants evidence that you know who your critical vendors are, what data they hold, and that you have asked. Demonstrated process beats perfect answers.
The Claims-Time Risk Nobody Plans For
Here is the part that deserves more attention than the underwriting inconvenience.
If a breach reaches you through a vendor, your answers on that application become part of the claims investigation. A carrier examining a supply-chain claim will look at what you represented about that vendor. If you affirmed that your top vendors provide SOC 2 Type II reports and the vendor at the origin of the breach never produced one, you have a misrepresentation problem layered on top of a security incident — and the coverage question becomes live at exactly the moment you need the coverage.
This is why the guidance to answer carefully is not pedantry. The failure mode is not a higher premium. It is a denied claim.
Two practices follow directly:
Never answer from memory or assumption. If you believe a vendor has a SOC 2 Type II, obtain the report or at least the current attestation letter before you write “yes.” Vendors furnish these routinely under NDA through a trust portal or on request from their security team.
Answer “no” or “unknown” when that is the truth, and say what you are doing about it. Underwriters price known gaps. They do not price undisclosed ones — they litigate them. An application that says “three of five vendors provide Type II; two are under review with remediation requested by Q1” is a stronger submission than a clean sheet that does not survive scrutiny.
Building the Evidence File
The work is mostly clerical, and it compounds because you reuse it every year.
Build a vendor inventory with data classification. Vendor name, what it does, what category of data it touches, and whether it is critical to operations. Rank by data sensitivity rather than by contract value — your cheapest vendor may hold your most sensitive data.
Collect attestations for the top tier. For each critical vendor: the current SOC 2 Type II report or equivalent, its coverage period, and the date you obtained it. Coverage period matters — a Type II from 2023 is not current evidence in 2026.
Read the exceptions section, not just the opinion. A SOC 2 Type II can contain noted exceptions and still be a clean report overall. Those exceptions are the most informative pages in the document and almost nobody reads them.
Record what you did when a vendor could not produce one. A short note — asked on this date, response was this, decision was to accept the risk or to plan replacement — is what converts a gap into managed risk. That documentation is what an underwriter and a claims adjuster are both looking for.
Put attestation requirements into new contracts. A clause requiring the vendor to maintain SOC 2 Type II or equivalent and to furnish the current report annually costs nothing at signing and eliminates the annual chase.
Where This Is Heading
Vendor risk remains the area of cyber insurance where practice lags exposure most visibly, which means the questions will keep expanding rather than settling. The reasonable expectation is that attestation requirements move from underwriting questionnaires into policy conditions — that is, from something you disclose into something you must maintain to keep coverage in force.
Operators who treat the vendor inventory as a permanent artifact rather than an annual scramble will find the next several renewals uneventful. The ones who reconstruct it from memory each August will eventually reconstruct it wrong, and will find out which answer was wrong at the least convenient possible moment.
Start the inventory now, before the renewal questionnaire arrives. The version you build under deadline is the version that contains the guess.
