DueHarbor

Practical guide

Cyber Insurance Renewal Checklist for IT and Ops Teams

Most teams know when their cyber policy expires. Fewer know when the renewal application is due, and that is the date that actually runs the process.

October 23, 2026 · 9 minute read

Why cyber insurance renewals miss dates

Most teams know when their cyber policy expires. Fewer know when the renewal application is due, and that is the date that actually runs the process.

A cyber insurance renewal usually means a questionnaire or application, often with supporting evidence, sent through a broker to the insurer for review before terms are offered. That work has to land well before the policy end date so there is time for follow up questions, a quote, and a decision. If the team starts when the expiration date feels close, the application is already late.

The usual reasons a renewal gets squeezed:

  • The broker's request for the renewal application landed in one person's inbox and sat there
  • Nobody owns the renewal as a whole, so IT assumes finance has it and finance assumes IT has it
  • The questionnaire touches several teams, and each section waits on a different person
  • Evidence from last year (screenshots, reports, policy documents) is out of date or cannot be found
  • Nobody kept a copy of last year's submitted answers, so the team starts from scratch and answers inconsistently

This checklist is for IT, ops, and finance teams who want the renewal organized, owned, and on time. It covers dates, owners, evidence refresh, reminders, and records. It is not insurance or legal advice. It does not tell you what coverage to buy, what limits to carry, or how to answer any question. Take those questions to your broker or insurer.

If you are looking for how to collect certificates of insurance from your vendors, that is a different job. See the vendor COI tracking checklist. This post is about your own cyber policy.

Start 90 to 120 days before the policy ends

Work backward from the policy expiration date. For many teams, 90 to 120 days out is a reasonable point to start, because the questionnaire, evidence, broker review, and any insurer follow up questions all take time. Ask your broker when they need your completed application for this renewal, and plan around that answer rather than a rule of thumb.

At the start date, do three things:

  • Confirm the dates: the policy expiration date from the current policy, and the application due date from your broker
  • Confirm the owner: one named person for the whole renewal, plus a backup
  • Get the materials:this year's questionnaire or application, last year's submitted version, and the evidence package you sent last time

If the broker has not sent this year's application yet, ask for it. Waiting for it to arrive is how a 120 day runway turns into 30.

Separate the three dates

A cyber renewal has at least three dates, and they mean different things. Track each one on its own.

  • Policy expiration date: when the current policy period ends. Copy it from the policy itself, not from memory or last year's calendar invite
  • Application due date: when your broker needs the completed questionnaire and evidence. This is usually well before the expiration date, and it is the date most likely to be missed
  • Decide-by date: when you need to accept terms or choose a path so the new policy is bound before the old one ends. Set this with your broker, and leave room for questions on the quote

Some renewals add more dates, such as a deadline to answer insurer follow up questions or a date to confirm payment. Add them as they appear. The point is that "the renewal date" is not one date. For more on giving every date a clear meaning, see how to track expiration and renewal dates without missing one.

Name an owner, then owners per section

The renewal needs one named owner and a backup. That person tracks the dates, chases the sections, talks to the broker, and makes sure the application goes out on time. In many smaller companies this is an IT lead, an ops lead, or a finance or admin lead, depending on who holds the broker relationship.

The questionnaire itself usually spans several teams. Assign an owner to each section, so nobody is waiting on a vague "someone in IT." A typical split:

  • IT: sections about systems, devices, accounts, backups, and how access is managed
  • Security (if you have a separate function): sections about security tools, testing, training, and incident planning
  • Finance: sections about revenue, payment processes, and anything that touches the premium or billing
  • Ops, HR, or legal (as relevant): sections about headcount, vendors, data handled, and internal policies
  • Broker: questions about what a section is asking, how the application is reviewed, and anything about coverage or terms

Each section owner gets a due date that lands before the application due date, so the renewal owner has time to review the full package. For a general model of assigning renewal owners and backups, see who should own software renewals. The same principles apply here. If the renewal owner changes jobs or leaves mid cycle, use the renewal owner offboarding handoff checklist so the dates and broker contact do not leave with them.

Inventory what to track

Keep one record for the policy renewal, and a short list of related items underneath it. At minimum:

  • Policy name and policy number: as they appear on the current policy
  • Insurer and broker: with a named broker contact and how to reach them
  • Policy period: start date and policy expiration date
  • Application due date: from the broker, confirmed in writing
  • Decide-by date: agreed with the broker
  • Renewal owner and backup
  • Questionnaire sections: each with an owner and an internal due date
  • Evidence items: each with an owner, the date it was last refreshed, and where the current version is saved
  • Status: not started, gathering, in review, submitted, follow up questions, terms received, bound
  • Source links:where the current policy, last year's application, and this year's package are stored

Track evidence refresh dates

Evidence goes stale. A report, screenshot, or policy document that was current last year may not reflect how things work now. For each evidence item, record when it was last refreshed and who refreshes it.

That gives you a simple rule: anything not refreshed since the last renewal gets a refresh task with a due date before the section is due. Which evidence the insurer wants, and what it should show, is a question for your broker. Your job here is to know what you sent, how old it is, and who updates it.

Set a reminder ladder on the application due date

Anchor reminders to the application due date, not the policy expiration date. The expiration date is the backstop. The application due date is where the work actually has to be finished.

A practical starting ladder:

  • 120 days before the policy ends: confirm dates, owner, and backup; request this year's application from the broker
  • On the application due date minus 45 days: assign section owners and evidence owners, with internal due dates
  • Minus 30 days: section owners start drafting from last year's answers; evidence refresh tasks are underway
  • Minus 14 days: section drafts due to the renewal owner; flag anything blocked
  • Minus 7 days: full package review, questions to the broker
  • Minus 3 days: final check and escalation for anything still missing
  • Due date: submit, and save exactly what was sent

After submission, keep reminders on the decide-by date and the policy expiration date, so follow up questions and the final decision do not drift. Adjust the spacing to what your broker says and how long last year actually took. For why a sequence of reminders beats a single one, see the 90/60/30-day renewal reminder schedule.

Keep last year's answers and evidence package

The most useful document in this renewal is last year's submitted application. Save it, along with the evidence package and any follow up questions and answers, in one place the next owner can find.

  • Save the exact application as submitted, not a working draft
  • Save the evidence package as sent, with the date it was sent
  • Save any follow up questions from the insurer or broker, and your replies
  • Save the terms you accepted and the date you accepted them
  • Note what took longest, and who you waited on

Starting from last year's answers saves time and helps you spot what changed. Where an answer is different this year, note why, and talk it through with your broker before you submit. Do not copy an old answer forward without checking that it is still accurate.

When the renewal is done

  • Confirm the new policy is bound and save the policy documents
  • Enter the new policy period and expiration date
  • Archive this year's submitted application and evidence alongside last year's
  • Update the owner and backup if anything changed
  • Set the next renewal's start reminder, counted back from the new expiration date
  • Note how long the process really took, and adjust next year's start date if it ran long

Weekly and quarterly rhythm

Weekly during the renewal (10 to 15 minutes): The renewal owner checks every section and evidence item against its internal due date, chases anything late, and confirms the application due date has not moved.

Quarterly, all year: Confirm the renewal owner and broker contact are still right. Check the evidence list for anything owned by someone who changed roles or left. Glance at the next policy expiration date so the start reminder is in place. Many teams fold this into their regular renewal review alongside software and vendor contracts. See the software renewal review checklist and how to run a quarterly renewal review meeting.

If you also track other non-software renewals, like licenses and permits, the same rhythm works. See the business license and permit renewal checklist.

Spreadsheet version

A spreadsheet can carry this for one policy. Use one tab or block for the policy record with columns for policy name, policy number, insurer, broker contact, policy start, policy expiration date, application due date, decide-by date, renewal owner, backup, and status.

Then add one row per questionnaire section and per evidence item, with columns for item, type (section or evidence), owner, internal due date, last refreshed date, status, and link to the current file. Add a computed "days until application due" column and highlight anything inside 30 days. Keep one master copy with one owner.

When the sheet starts to drift (section owners left blank, reminders living in one person's calendar, nobody sure which evidence is current) see how to move renewal tracking out of spreadsheets.

FAQ

When should we start preparing for a cyber insurance renewal?

Many teams start 90 to 120 days before the policy expiration date. The better anchor is the application due date from your broker. Ask them when they need your completed application, and start early enough to get every section and evidence item done before then.

What is the difference between the policy expiration date and the application due date?

The policy expiration date is when the current policy period ends. The application due date is when your broker needs your completed questionnaire and evidence, which is usually well before expiration. Track both, and set reminders on the application due date.

Who should own the cyber insurance renewal?

One named person with a backup, often in IT, ops, or finance, depending on who works with the broker. That person owns the dates and the full package. Individual questionnaire sections and evidence items each get their own owner.

Should we reuse last year's questionnaire answers?

Use them as a starting point, not a final answer. Compare each answer against how things work today, and update anything that changed. If you are unsure how to answer a question, ask your broker.

Does this checklist tell us what coverage we need?

No. It keeps the renewal process organized and on time. Coverage, limits, terms, and how to answer the application are questions for your broker or insurer.

Is this the same as tracking vendor certificates of insurance?

No. Vendor COIs are proof of insurance you collect from vendors. This checklist is about your own cyber policy. For vendor COIs, see the vendor COI tracking checklist.