Responding to Cyber Questionnaire Resistance

A cyber questionnaire lands on a CFO's desk and reads like an interrogation. Every line asks about internal controls, incident history, and technical details the CFO may not fully own. When that CFO has already dealt with a security scare or an uncomfortable audit, the questionnaire feels like one more party asking for information the company would rather keep close. As the commercial producer, you did not write the questionnaire and you cannot vouch for controls you have never seen. Your job is to explain why the carrier needs verified answers and to bring the right person into the conversation before the CFO shuts the whole process down.

Why this conversation goes wrong

Producers often treat questionnaire resistance as a stalling tactic, so they push for a quick yes. That approach backfires for two reasons. First, the CFO's caution is often legitimate, not evasive. A finance leader who has watched a phishing incident or a failed audit finding get discussed in a board meeting has good reason to be careful about who sees which internal detail. Second, when a producer promises "we meet the requirement" without proof, that statement becomes a representation the carrier can hold the account to later. If the actual controls fall short of what got promised, a claim can get denied on a technicality that has nothing to do with whether a breach happened. The result is a producer caught between a customer who feels interrogated and an underwriter who needs facts before binding coverage. Renewal deadlines make this worse. A producer watching a date approach starts to see the questionnaire as the obstacle, when the real obstacle is that nobody has organized who answers what. The conversation goes wrong the moment the producer tries to solve both the trust problem and the accuracy problem by talking faster, instead of by assigning the right questions to the right person.

How to prepare

Before the call, separate the questionnaire into categories. Some questions are financial or organizational, and the CFO can answer them directly. Revenue by location, number of employees with access to sensitive data, and whether the company carries a cyber policy today all fall in this group. Other questions are technical, covering multi factor authentication, endpoint detection, backup testing, and patch cadence. Those belong to an IT director or a managed security provider, not to the CFO, and pretending otherwise sets up a bad answer. Write down which questions fall in which bucket before you ever get on the phone. Know the carrier's deadline, and know what happens if the account misses it, whether that means a lapse in coverage, a higher rate, or a request for an extension. Bring one alternative to a written form response, such as a short working session where the IT contact answers a screen at a time while you or an account manager records the responses. This kind of stakeholder mapping looks a lot like the groundwork needed when Preparing a Dependent Eligibility Reviewwhere the right document has to come from the person who actually holds it, not from whoever answers the phone. Giving the CFO a concrete plan, instead of a vague request for more information, is what lets them protect internal detail while still moving the account forward.

What to say

Open by naming the concern directly rather than waiting for it to surface as a refusal. You might say, "I know this questionnaire asks for detail that touches sensitive parts of your environment, and you are right to be careful about who sees it."

The CFO responds the way most do. "Half of this I do not even know the answer to, and I am not sending our security setup to a stranger. Can you just tell them we meet what they are asking for."

Do not answer that with an assurance. Say instead, "I cannot represent your controls to the carrier, and I would not want to guess on your behalf, because a wrong answer here could affect a claim later. What I can do is split this into two groups. You can answer the financial and organizational questions directly. The technical questions, things like multi factor authentication and backup testing, need to come from whoever manages your IT, whether that is an internal director or an outside provider. Would a thirty minute working session with that person next week let us get through the technical section together."

That gets you a name and a date. "Our IT is outsourced to a third party firm. I can loop in their lead."

Close the loop with a next step, not just an agreement. "Good. I will send both of you the technical section marked separately from the financial section, and we will walk through it together next Tuesday. Anything you are not sure about, we leave blank until their lead weighs in, and I will flag it for the underwriter as pending rather than guessing."

Mistakes to avoid

Do not fill a gap with an assumed yes. If the CFO does not know whether the company runs endpoint detection, silence is a better answer than "probably." Do not treat the CFO as the only source of truth on the account. Insist that any question outside their knowledge get answered by name, in writing, by whoever owns the control. Do not let confidentiality worries turn into an incomplete form and a missed deadline. A blank form does not protect the account. It just delays the same conversation to a worse moment, closer to the renewal date, with less time to get it right. Do not argue with the CFO about whether the concern is reasonable. It usually is. The disagreement is not about whether they should protect internal detail. It is about how the account gets a complete, accurate submission without you improvising on facts you cannot verify. This is the same discipline a producer needs when Responding to Anger About a Denial Letterwhere the temptation to soothe the person in front of you by filling in a gap in the story leads to a promise you cannot back up.

How to practice and score it

Practice this exchange with a colleague before you try it live, and score three things afterward. Did you name the confidentiality concern out loud instead of pushing past it. Did you avoid making any statement that sounds like an attestation to a control, even an implied one like "that should be fine." Did the conversation end with a specific person named and a specific time set, rather than a vague promise to follow up later. If your manager wants to build this into coaching, they can play the CFO and push back hard, using lines like "just tell them we are covered," to see whether the producer holds the line under pressure or caves to close the conversation faster. Watch for the moment the producer starts guessing instead of assigning. That is the failure point, and it is worth replaying until the producer catches themselves before it happens. DealSpeak's Insurance practice conversations library includes this scenario alongside others built for commercial producers, so a team can run it several times with different levels of resistance before anyone faces it with a real account. Score the producer on the plan they leave with, not on how smoothly the call sounded.

Close

A cyber questionnaire is not an accusation, and treating the CFO's caution as an obstacle only slows the account down. Split the questions, name the right owner for each answer, and set a specific working session instead of guessing. Handled that way, this scenario in DealSpeak turns a defensive CFO into a partner who trusts the process, because you protected both their information and the accuracy of the submission.