Most cyber insurance applications now run 20 to 40 control questions, and four of them fail construction firms more than the rest: multi-factor authentication on remote access, EDR rather than antivirus, backups that are immutable or offline, and a restore test you can put a date on. A 10-to-50-person firm starting from a partial stack needs a few weeks before renewal to answer yes honestly and roughly $100 to $350 per seat per month to maintain compliance. Below are the 10 most common questions carriers ask and the 3 areas most construction firms fail.

These Are the Same Controls Your GC Already Asked About

The control list on a cyber application overlaps with a general contractor's prequalification packet: MFA, EDR, tested backups, training, patching, incident response. Both want documentation rather than assurances, so one remediation project satisfies both. If you're already working through a GC security questionnaire, you're most of the way to a clean application, and the evidence is reusable: restore-test report, training export, patch report.

The Questions:

Yours may word these differently, but the substance is consistent.

  1. Is MFA enforced on all email accounts and remote access? Enforced by policy on 100% of mailboxes and every path in.
  2. Is MFA enforced on privileged and administrative accounts? Domain admins, Microsoft 365 global admins, etc. These are the accounts attackers want.
  3. Do you deploy EDR across all endpoints?
  4. Do you have multiple backups, including one offline, and when did you last test a restore?
  5. Are administrative privileges restricted and managed? No local admin rights on daily-use accounts; admin accounts separate, inventoried, and logged.
  6. Do you filter inbound email for malicious content? Advanced filtering beyond default mail hygiene, plus SPF, DKIM, and DMARC so nobody can spoof your firm to a GC or supplier.
  7. Do all employees complete security awareness training? Annual training for everyone with network access, field supervisors included, plus phishing simulations and exportable records.
  8. How quickly are critical patches applied?
  9. Do you have a written incident response plan? A document naming roles, after-hours numbers, the carrier's claim hotline, and notification steps.
  10. Do you operate end-of-life or unsupported systems?

A Wrong "Yes" Can Void the Coverage You're Buying

A cyber insurance application is a signed representation. An owner signs it, and that signature says the statements are true. The controls you attest to become part of the basis the policy was written on, and some policies make specific controls a condition of coverage.

So consider checking the EDR box while running consumer antivirus, then getting hit. You file a claim, the carrier's forensics team images your machines, and they see exactly what was installed. The answer and the evidence don't match, and the conversation is no longer about your claim.

Depending on the policy and the jurisdiction, that can mean a denied claim, a rescinded policy, or a fight with your own carrier at the exact moment you needed them: production stopped, project files encrypted, a GC asking when you'll be back up. Years of premiums, and a "no" in the worst week of your firm's history.

Most common failure: the application arrives by email with everything else, the office manager answers yes to MFA because she gets a code on her phone, and nobody checks whether it's enforced across all 34 accounts. She wasn't wrong about her login. The firm still misrepresented a control.

Where Most Construction Firms Fail

  1. End-of-life machines running old design software

A workstation in the corner runs a version of AutoCAD, or a plotter driver, that won't work on anything current, so it never got replaced. Unsupported operating system are a big security risk because they no longer receive critical updates or patches.

  1. Shared accounts in the field

One login for the trailer PC. One tablet account 4 foremen use. Shared credentials break MFA, access control, and the audit trail a claim investigation depends on.

  1. Unmanaged personal devices touching project files

A superintendent's phone syncing to the project folder. A PM's home laptop opening submittals on Sunday. If a device holds company data and you can't inventory, patch, or wipe it, your honest answers on EDR and access are narrower than you think. Secure remote access to plans lets field staff work from anywhere without data landing on devices nobody controls.

Most common failure: the endpoint questions get answered from the office computer list, because that's what the inventory covers. The trailer machines, the shop PC, and the tablets living in trucks never got counted, and those are the ones on hotel Wi-Fi.

Why Construction Firms Work With Alexaur

We've supported architecture, engineering, and construction firms across Katy, TX and Greater West Houston since 2001, and we're still family-owned. The person who answers your call knows why the trailer machine matters.

Insurance Renewal Date on the Calendar?

If your renewal is inside 90 days and you're not certain which questions you can honestly answer yes to, let's fix that first while there's still time to close a gap instead of disclose one.

Send us the control questions from your application, not the coverage pages, and book a 15-minute discovery call. We'll tell you which answers your current setup supports, which it doesn't, and how long each gap takes to close.

Call 281-646-1200 or email results@alexaur.com.