What Goes in a Monthly Evidence File, and How to Use It at Insurance Renewal

Why “we have software” is not an answer #

Applications ask about three things: monitoring, logging and incident response. Logging is the record of activity. CISA describes logs as showing who accessed what, when and from where. Monitoring is someone reviewing those records for anything unusual. A tool running in the background shows neither.

Several IT providers say renewals now lean toward proof. Fisch Solutions, a managed IT provider, wrote in January 2026 that renewals “require proof, not promises.” Sentry Technology Solutions says carriers increasingly want a compiled evidence package rather than questionnaire answers. Both are IT-provider guides, not insurer rules. Treat them as a signal, not a standard.

What applications are reported to ask #

The best-sourced list comes from the Indiana Cybersecurity Hub, a state government resource. It publishes sample questions “typical for a cybersecurity insurance application.” They include whether the applicant monitors its network and endpoints for unusual activity, and whether it keeps records of that monitoring and of any response, and reviews them often. They also ask whether there is a written incident response plan, and whether multi-factor authentication is required for administrative access, web email, cloud services and backups. The page says these are illustrations, not a required form.

Other sources add detail, and each speaks only for itself:

• Watched alerts. Fisch says underwriters ask who monitors alerts and how quickly the team responds, and that basic antivirus is not enough. Sentry says endpoint detection and response (software that watches computers for signs of attack) with active monitoring is a baseline.
• Record keeping. CISA gives no retention period for business logs, and we found no insurer-published number. Ask your broker how long records must be kept.
• A written plan. Sentry says the plan should be rehearsed through tabletop exercises within the past 12 months.
• Who does the forensics. A 2021 post from McCarthy Tetrault, a Canadian law firm, says some policies require the insured to use the insurer’s pre-selected providers and to get approval before engaging one. That is Canadian, older, and about policy wording. It is a reason to read your policy, not proof that carriers require a standing forensics contact.

Forms vary by carrier. Your broker is the one to confirm with.

What the monthly evidence file holds #

Ours is one short document each month, in three parts.

Coverage answers: what were we actually watching, and was it working? Every other answer depends on scope. A record that shows gaps honestly, month after month, is more believable than a claim that everything is covered. It is also where the question of how long records are kept gets a written answer.

Alerts and cases answers: what came up, and what happened next? It covers alerts, cases, how quickly each was acknowledged, what is still open, and how each one ended. This is the paper behind the sample question about records of monitoring and response. It shows a person looked, not just that a tool ran. For how a real alert becomes a case, see What Happens When We Find Something.

Decisions answers: who chose what, and what was put off on purpose? It records top risks, changes made, and next steps, each with an owner and a due date. An unfinished item with a named owner and a date reads very differently from one nobody mentioned.

We are not publishing the layout. What matters is the kind of evidence: dated, specific, and tied to a named person.

How to use it at renewal #

1. Start early. Sentry advises beginning at least 90 days before renewal, and says starting 60 days out or less leads to rushed changes that underwriters can detect. With one file a month, three months out gives you three files.
2. Send recent files with the application. Give your broker the latest few, not a single month. Several months show a routine instead of a one-off.
3. Use the decisions part to explain delays. If a fix is scheduled for next quarter, the file shows who agreed and when it is due.
4. Match the exact wording. Copy each application question onto a page. Next to each, note which part of the file answers it, and say plainly where nothing does. Answers should match what actually runs.
5. Ask before you assume. Forms vary by carrier, so confirm with your broker which questions apply to you and what proof they want for each.

What the evidence file is not #

It records real monitoring and real response. It isn’t a compliance certificate. Your broker, carrier or customer decides whether it answers their questions. We make no promise that any carrier will accept it or that it will change what you pay. It is also not digital forensics, breach counsel or a regulatory notice. Those are separate jobs.

Three questions to ask your broker #

1. Which questions on our application are about monitoring, logging and incident response, and what proof do you want for each?
2. How long must records be kept, and in what form do you need them?
3. Does our policy require an insurer-approved forensics or legal provider, or consent before we engage one?

Sources #

• CISA, Use Logging on Business Systems: definitions of logging and monitoring.
• Indiana Cybersecurity Hub, Underwriting Security Controls Questions and Resources: sample application questions.
• Sentry Technology Solutions, Cyber Insurance Renewals: What’s Changing in 2026 and How to Prepare: evidence package, endpoint baseline, tabletop exercises, 90-day timing.
• Fisch Solutions, Cyber Insurance Requirements 2026: “proof, not promises” and the alert monitoring questions.
• McCarthy Tetrault, Getting Cyber Insurance Right: 5 Practical Tips: panel providers and insurer approval (Canada, 2021).

What to do next #

Start with your broker’s questions, not with a file. Get the application wording, ask the three questions above, and begin collecting monthly records while there is still time for several of them to exist.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check