Why government entities are a distinct risk category
In the FBI IC3 2023 Internet Crime Report, Government Facilities ranked third among critical infrastructure sectors reporting ransomware (156 of 1,193 critical-infrastructure ransomware complaints), and the 2025 report again lists Government Facilities among the three sectors most affected by the top ransomware variants. The CISA Government Services and Facilities Sector covers buildings "owned or leased by federal, state, local, and tribal governments," so the IC3 sector figures are not limited to state and local entities, and IC3 counts only reported complaints. The characteristics that make government attractive to attackers — public sector data, critical service dependencies, political pressure, and complex vendor ecosystems — also make government a distinct actuarial risk for insurers.
State and local government presents specific risk factors that cyber underwriters price separately from commercial enterprises:
- Service continuity pressure. Ransomware operators know that government agencies face immediate political accountability for service disruption. Benefits agencies that cannot process claims, DMV offices that cannot issue licenses, and emergency services that cannot dispatch all face direct constituent impact within hours. That pressure shortens the decision cycle on ransom payment.
- Legacy system exposure. Many state agencies run core functions on systems built decades ago, with limited patching cadence, minimal network segmentation, and integrations that were never designed with modern threat models. Unpatched and poorly segmented legacy environments widen the attack surface ransomware operators exploit.
- Vendor and third-party access. State agencies routinely grant system access to software vendors, managed service providers, and consultants under long-standing agreements that predate current access management requirements. CISA has warned that threat actors can use a vulnerable managed service provider as an initial access vector to multiple victim networks.
These characteristics are visible to insurers through underwriting questionnaires, loss history, and industry data. State and local government is not pooled with commercial enterprise. Underwriters apply government-specific models, and state CISOs who treat government insurance procurement as equivalent to commercial IT insurance are likely to misread the requirements.
The evolution of the underwriting questionnaire
In Spartan X's analysis, cyber insurance questionnaires have moved through three broad functional generations in the past decade. The date ranges are approximate and vary by carrier and market.
First generation (approximately 2015–2019): Attestation-based. Questions were binary: "Do you have a security policy? Do you require MFA for remote access? Do you have an incident response plan?" Answers were self-reported without documentation requirements. Underwriters priced primarily on revenue, sector, and self-reported control posture.
Second generation (approximately 2020–2022): Coverage-based. Binary questions gave way to coverage percentages and population specifics. "What percentage of email accounts have MFA enforced?" "What percentage of endpoints have endpoint detection and response deployed?" "What percentage of privileged accounts are enrolled in privileged access management?" These questions required an answer that went beyond attestation — it required the agency to know its own coverage, which many did not.
In Spartan X's assessment, the shift was driven by large claims: large ransomware claims exposed the limits of yes/no attestations as a predictor of control effectiveness. Consider a hypothetical agency that attested to MFA but had enrolled only 40 percent of its accounts: in a breach, its exposure would look very different from an agency with full enrollment. Yes/no attestations could not distinguish the two, and insurers repriced accordingly.
Third generation (2023–present): Evidence-based. In Spartan X's assessment, questionnaires used by many carriers now pair attestations and coverage questions with documentation requests — for example IR plans, tabletop exercise records, architecture summaries, vendor access records and backup testing records. Requirements vary by carrier, program and limit; confirm the specific list with your broker.
State CISOs should request a copy of their current insurer's questionnaire early — ideally 90 to 120 days before renewal — to understand which generation it represents and what documentation it will require.
What current questionnaires actually assess
The specific items that recur across government-sector cyber underwriting questionnaires include the following. Each item is followed by what an adequate response requires — not just the control itself, but the documentation that supports it.
Multi-factor authentication (MFA) Questions have moved from "do you require MFA?" to "what percentage of accounts enforce MFA for remote access?" and "what percentage of privileged and administrative accounts enforce MFA?" Adequate documentation is an identity management system report showing enrollment counts by account type, confirming that exceptions are approved and time-limited, and identifying the mechanism (token, authenticator app, hardware key) used for privileged accounts.
An agency that has deployed MFA broadly but cannot produce a coverage report is in a materially weaker position at renewal than the control posture alone would suggest. Insurers interpret the absence of a coverage report as a monitoring gap, which is itself a risk indicator.
Endpoint detection and response (EDR) Insurers ask for EDR coverage as a percentage of total managed endpoints, and increasingly ask separately about server coverage vs. workstation coverage and about operating system version distribution. Adequate documentation includes an asset inventory confirming total managed endpoint count, an EDR console report confirming enrolled endpoint count, and a process for onboarding new devices.
Privileged access management (PAM) Questions ask whether privileged credentials are vaulted, whether session recording is enabled for administrative sessions, and whether just-in-time access is implemented. Documentation requirements are a PAM platform report confirming vault enrollment by credential type, session recording coverage, and any exceptions with documented justification.
Network segmentation Questions ask whether critical systems are logically segmented from user endpoints, whether OT/ICS environments are isolated (where applicable), and whether east-west traffic is monitored. Documentation requires a network architecture summary confirming segmentation, VLAN structure, and access control lists governing cross-segment traffic.
Immutable or offline backups Questions have become specific: "Are backups stored in a location that is not accessible from the primary network?" "What is the tested recovery time for critical systems?" "When was the last backup restoration test performed?" Adequate documentation is a backup system report confirming offline or immutable storage status, a restoration test record with date and recovery time achieved, and a recovery time objective documented in the DR plan.
Email security controls Questions specifically ask whether DMARC is configured for all email domains, whether DKIM and SPF are implemented, and whether anti-phishing simulation training has been completed. Documentation includes DMARC configuration confirmation (enforcement-level, not monitor-only), and training completion records by completion date and percentage.
Incident response preparedness Current questionnaires ask for the date of the last tabletop exercise, whether external responders were included, and the scenarios tested. An IR plan document alone is not sufficient; insurers want evidence of practiced response. Documentation is a tabletop exercise record with date, scenario scope, participants, and findings.
Vendor and third-party access Questions ask whether a vendor access registry exists, whether privileged vendor access is time-limited, and whether vendors are required to meet security standards as a contract condition. Documentation is a vendor access inventory confirming current active vendor sessions and their access scope.
The documentation gap
The most common renewal friction for state agencies is not a missing security control — it is a missing record. Many state agencies have deployed MFA but cannot produce a report showing what percentage of accounts are enrolled. They have an IR plan but cannot provide a tabletop exercise record with a date in the past 12 months. They have EDR deployed but lack an authoritative count of total managed endpoints to calculate coverage percentage.
The documentation gap has two practical consequences at renewal. First, it forces the agency to collect the evidence under deadline pressure, which increases the risk of submitting inaccurate information. An accurate questionnaire requires the same evidence as a complete renewal packet; collecting it 10 days before renewal produces both a stressful process and a higher risk of errors.
Second, the inability to answer coverage questions — even when controls exist — signals a monitoring gap to underwriters. An agency that cannot answer "what percentage of endpoints have EDR deployed?" is communicating that it does not continuously measure its own security posture. Continuous measurement is itself a control, and its absence is a risk indicator independent of the underlying tools deployed.
Using the questionnaire as a security program driver
The practical value of the underwriting questionnaire is that it is more operationally specific than most state agency self-assessments. State security self-assessments tend to be policy-level documents: "we have an MFA policy, we have an EDR deployment plan." The questionnaire demands the operational evidence behind those policies.
For state CISOs building or improving security measurement programs, the questionnaire is a useful template. Working backwards from the questionnaire creates a prioritized list of measurements:
- MFA coverage by account type → requires identity management reporting
- EDR coverage percentage → requires authoritative asset inventory
- Privileged access under PAM → requires credential vault reporting
- Backup restoration test records → requires documented DR testing cadence
- Tabletop exercise date and scope → requires IR program formalization
- Vendor access registry → requires access management for external parties
Each measurement that the questionnaire requires is a measurement that would independently improve security visibility. Agencies that build their measurement program to answer the questionnaire will, as a side effect, build a more governed and measurable security posture.
A preparation timeline
For state CISOs managing annual renewal, the following sequence distributes the work appropriately rather than concentrating it at deadline.
90–120 days before renewal:
- Obtain a copy of the current underwriting questionnaire from the broker
- Compare questionnaire line items against the previous year's responses
- Identify items where the control has changed (upgraded, expanded, or reduced)
- Identify items where the documentation format has changed
60–90 days before renewal:
- Collect documentation for each questionnaire item from the relevant system owners (identity management, endpoint management, networking, backup, IR)
- Identify gaps where documentation cannot be produced
- For gaps, determine whether a documentation deficit or a control deficit exists
30–60 days before renewal:
- Assemble the completed questionnaire with supporting documentation
- Conduct an internal review with the CISO and CIO to verify accuracy
- Submit to the broker with sufficient lead time for underwriting review
At renewal:
- Confirm coverage terms, exclusions, and sub-limits
- Note any changes from prior year terms that reflect control improvements or deterioration
- Document renewal terms and questionnaire responses for use in next year's 120-day preparation
Coverage terms state CISOs should understand
Cyber insurance policies for government entities include terms and exclusions that are specific to the sector. State CISOs should understand the following before renewal, rather than discovering them at claim time.
State-sponsored actor exclusions. Some policies include exclusions for "acts of war" or events attributed to nation-state actors. Market language has moved toward more explicit state-backed attack wording. Lloyd's, for example, required standalone cyber-attack policies written at Lloyd's to carry a state backed cyber-attack exclusion from 31 March 2023 (Market Bulletin Y5381). Government entities, which are frequent targets of sophisticated state-affiliated actors (CISA reported that Russian state-sponsored APT actors targeted dozens of SLTT government networks), should ask their brokers to explain exactly what state-sponsorship attribution means in their policy's exclusion language and what evidence would trigger the exclusion.
Business interruption coverage for government services. Commercial business interruption coverage is typically calculated against revenue loss. Government entities do not have revenue in the same sense. Policy language should explicitly address the scope of business interruption coverage for government — specifically, whether it covers costs incurred to maintain services by alternative means during a system outage, including manual processing, contractor augmentation, or alternate-site operations.
Ransomware response and payment provisions. Policies vary on whether ransom payment is covered, under what conditions, and whether prior insurer approval is required. State CISOs should understand this provision before an incident, not during one. The operational reality is that ransom payment decisions are time-sensitive; a policy that requires prior approval needs a process for obtaining that approval at 2 a.m. on a Saturday.
Sub-limits for critical systems. Some policies apply sublimits to specific system categories, infrastructure types, or incident types. A sub-limit for critical infrastructure incidents in a state that runs water utility systems or power grid monitoring would significantly reduce effective coverage in the incidents most likely to draw public attention.
Spartan X's approach to state security assessment
Spartan X's security advisory work for state government agencies integrates operational measurement with compliance and governance requirements. The renewal pattern described here — controls deployed but not measured, tooling installed but not inventoried, coverage gaps invisible until a questionnaire or incident reveals them — is the problem security program documentation addresses. Understanding what you have, where it applies, and how to demonstrate it is the foundation of both a defensible insurance posture and an effective security program.
Sources and further reading
- FBI Internet Crime Complaint Center (IC3) Annual Report, 2023: ic3.gov
- National Association of Insurance Commissioners (NAIC), Cybersecurity (H) Working Group, including the NAIC Cyber Insurance Report: naic.org
- Lloyd's Market Bulletin Y5381, state backed cyber-attack exclusions: lloyds.com
- CISA, "Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure" (AA22-011A): cisa.gov
- CISA, "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (AA22-131A): cisa.gov
- CISA, Government Services and Facilities Sector: cisa.gov
- CISA, Known Exploited Vulnerabilities Catalog: cisa.gov
