CyberWave

Resources

Checklists and templates for the deadline you already have.

Four working documents, published in full: what an underwriter asks before a cyber insurance renewal, what counts as evidence that a control operated, how to size an ISO/IEC 27001:2022 programme, and how to report security to a board. Read each one here, or download it as a PDF — there is no form in front of either.

  1. The control questions cyber insurance applications ask most often, in rough submission order, with the evidence each answer needs, the gap that usually turns up, and the answer worth aiming for at the next renewal.

    Read the checklist: Cyber Insurance Renewal Readiness ChecklistDownload PDF: Cyber Insurance Renewal Readiness Checklist (413 KB)

  2. What separates a policy from proof that a control operated, the quality tests that decide whether evidence is accepted, and a checklist of acceptable evidence and common rejection reasons for twelve control areas.

    Read the checklist: Security and Compliance Evidence Collection ChecklistDownload PDF: Security and Compliance Evidence Collection Checklist (384 KB)

  3. A structure for reporting cybersecurity to a board that has ten minutes: where the organisation stands, what moved since last time, what is overdue, and the decisions that need the people in the room.

    Read the template: Board Cybersecurity Report TemplateDownload PDF: Board Cybersecurity Report Template (1.0 MB)

  4. A readiness pass over ISO/IEC 27001:2022: the management system clauses turned into questions, the Annex A themes with a line for every applicability decision, and an honest way to size the distance to a certification audit.

    Read the checklist: ISO/IEC 27001:2022 Readiness ChecklistDownload PDF: ISO/IEC 27001:2022 Readiness Checklist (435 KB)

On request

Two more, not published on this site.

A security questionnaire checklist and a cyber risk register template are described below but are not published here. If either would help with something you are working on, ask for it and say what it is for.

A checklist tells you where you stood on the day you filled it in.

Each of these documents is accurate the week you complete it, and quietly wrong three months later — the policy moved, the owner left, the restore test never got repeated, and nothing in the file knows any of it.

After the checklist

Where the answers go once the document is done.

Every document here works on paper, in a spreadsheet or with your own consultant. What a file cannot do is notice when an owner leaves or a piece of evidence passes its date. Sentinel holds the same answers against controls, owners and expiry dates.

  • Status and expiry on every evidence item — so a lapsed restore test shows as expired rather than surfacing in the week a form is due
  • Linked to the control and the owner — which is the part a spreadsheet structurally cannot do
  • One item, several frameworks — a piece of evidence can be linked to requirements in more than one framework

See how the evidence library works

Example Sentinel screen, reproduced with fictional data: Evidence. 41 Accepted, 2 Needs Review, 1 Pending, 1 Expired, 1 Missing, and a register of evidence items with control, owner, status and validity, expiring first.
Prepare for a renewalCompare the frameworksSee executive reporting

Questions

Before you use them.

Answered here so you can decide whether any of this is worth your time without sending a message to find out.

Do I have to give an email address to read or download these?
No. Each document is published as a page, and the PDF is a direct download of the same page. There is no form in front of either.
Can we use them with our own consultant, auditor or broker?
Yes. They are readiness material and depend on no CyberWave software. They are most useful before a scoping conversation or a submission, when knowing what you already hold makes professional time go further.
If I work through a checklist honestly, does that make us compliant?
No. A checklist tells you where you stand against a set of questions on the day you answered them. Certification and audit opinions come from accredited certification bodies and licensed audit firms, and nothing on this site substitutes for that. The point of a readiness pass is to find what is missing before somebody external does.
Will the insurance checklist tell me what my premium will be?
No, and be wary of anything that claims to. Premium and coverage are decided by an insurer against its own appetite and your whole submission. What a readiness pass does is stop you answering an underwriting question from memory two days before the renewal.
Which one should I start with?
Start with the deadline you already have. A renewal in the next two months points at the insurance renewal checklist. An audit, a certification or a customer security review points at the evidence collection checklist. A board or audit committee meeting in the diary points at the report template. If you have been asked to get ISO 27001 and nothing is due yet, the ISO checklist is the way to size the work.
How current are they?
Each one shows the date it was last reviewed, at the top of the page and in the PDF. If you find something out of date, say so — support@cyberwave.ca reaches a person.
Everything else people askTalk to an advisor

Bring the deadline you are working to.

A renewal, a questionnaire, an audit someone has scheduled, a board meeting in the diary. Name the thing with a date on it and we can work backwards from it with you.

Start your 14-day free trial

No credit card required

  • Published pricing on every standard plan
  • No credit card required for the trial
  • No automatic charge when a trial ends
  • Tenant-isolated architecture, data stored in Canada
  • Clear data-processing terms
  • No compliance guarantee — human judgement still required