Source-linked control evidence with collection mode, freshness, and attestation tier — what underwriters increasingly require instead of questionnaire-only responses.
Cyber insurance renewal evidence
Cyber insurance renewal evidence package — source-linked controls, freshness-dated, organized by underwriter scoring category.
Valty produces a cyber insurance renewal evidence package from source-connected control data. CFOs and CISOs get a proof pack organized by the controls underwriters score most heavily — with collection mode, freshness, and claim state visible before submission.
Review proof and audit workflowDesign partnerPublic / indexed
An exportable evidence package organized by the control categories underwriters score: MFA, EDR, backup, IR plan, and network segmentation.
Underwriter evidence requests increasingly specify evidence collection date. Stale controls and point-in-time assessments create coverage gaps at renewal.
CFO question
What evidence does the underwriter need, and how do we produce it without a manual evidence sprint?
Insurance renewal is increasingly evidence-driven. CFOs need an evidence package that can be produced from connected source systems — not assembled from spreadsheets and assessment PDFs weeks before the renewal date.
CISO question
Which controls are the underwriter scoring and what does current evidence actually show?
CISOs need to see the actual control state — source-linked, freshness-dated, and organized by underwriter scoring category — before the renewal questionnaire locks in claims that cannot be substantiated.
Evidence standard
What separates evidence the underwriter accepts from evidence they treat as self-attestation?
Underwriters distinguish between source-verified evidence (scanner, cloud API, identity provider), agent-assisted attestation, and manual self-certification. Source tier affects both coverage and premium outcome.
Renewal evidence package
Controls the underwriter scores — with source, freshness, and collection mode attached.
The renewal evidence package is structured around the control categories that determine cyber insurance coverage and premium: MFA enforcement, EDR deployment and alerting, backup cadence and recovery testing, incident response plan currency, and network segmentation. Each control is evidence-backed to its source system with collection date visible.
- MFA evidence: identity provider API signal with enrollment rate and enforcement scope
- EDR evidence: endpoint platform coverage percentage with collection date
- Backup evidence: recovery cadence, last test date, and offsite replication state
- IR plan evidence: document version, review date, and tabletop exercise record
- Network segmentation: architecture attestation with reviewable source artifact
Evidence package reflects the state of connected source systems at the time of export. Coverage scope is bounded by source connector access agreed at setup. Valty does not issue insurance opinions or guarantee underwriter acceptance of any evidence package.
Controls organized by underwriter scoring category
Valty organizes control evidence by the categories underwriters weight most heavily: multi-factor authentication, endpoint detection and response, backup and recovery, incident response plan, and network segmentation.
Evidence tied to source system with collection date
Each control is evidence-backed to its source: identity provider signals for MFA, EDR platform API for endpoint coverage, backup system logs for recovery cadence. Collection date and freshness are attached.
Collection mode visible to underwriter
The evidence package labels each control as automated (source-verified), assisted (agent-supported), or manual (owner-attested) — so the underwriter can apply appropriate reliance without guessing.
Renewal evidence package exported with claim state
The renewal pack includes only publishable claims — stale or unattested controls appear in the blocked ledger so gaps are disclosed cleanly rather than hidden in a questionnaire response.
Evidence collection mode
Underwriters distinguish evidence tier. Valty makes it visible.
Source-verified evidence (T1 hardware-attested, T2 API-verified) carries higher reliance than owner-attested manual responses. The renewal package labels each control so the underwriter — and the CISO — can see exactly what is backing each claim.
Highest reliance
Source-verified (T1–T2)
Control evidence collected directly from identity providers, EDR platforms, cloud APIs, or backup systems. Collection timestamp and API scope preserved.
- MFA enforcement from IdP API
- EDR coverage from endpoint platform
- Backup cadence from storage API
Mid-tier reliance
Agent-assisted (T3)
Evidence where Valty prompts the owner, validates the response format, and records the attestation chain. Used for policy documents, vendor questionnaires, and IR plan reviews.
- IR plan version and review date
- Vendor security questionnaire intake
- Network diagram attestation
Disclosed self-attestation
Owner-attested (T4)
Manual owner submission with reviewer and date recorded. Labeled clearly in the renewal package — underwriters see it as self-attestation, not source-verified evidence.
- Physical control statement
- Exception documentation
- Manual policy sign-off
Proof matrix
Renewal evidence claims and their proof requirements
Each renewal claim requires source, collection mode, and freshness before it enters the evidence package. The blocked-claim ledger discloses gaps honestly rather than burying them in questionnaire language.
ClaimSourceConfidenceFreshness
MFA enforcement evidenceIdentity provider API: enrollment rate and enforcement scopeSource-verified (T2) — labeled by IdP signal dateAPI sync cadence; flagged if IdP signal exceeds 30 days
EDR coverage evidenceEndpoint platform API: coverage %, last alert, agent versionSource-verified (T2) — labeled by platform export datePlatform sync; stale if agent version >90 days behind current
Backup and recovery evidenceBackup system logs: cadence, last test date, offsite replicationSource-verified (T2) or agent-assisted (T3) for test recordsBackup API sync; recovery test date manually tracked
Incident response plan evidenceDocument version, review date, tabletop exercise recordOwner-attested (T4) — labeled as self-attestation in packageRe-review date set at attestation; flagged if >12 months elapsed
Blocked renewal claim (stale evidence)Control artifact expired or source not connectedNot publishable — appears in gap ledger with action requiredOwner or source refresh required before renewal submission
Arrive at renewal with source-linked evidence — not a questionnaire sprint.
Valty organizes control evidence by underwriter scoring category, labels each claim by collection mode and freshness, and packages the renewal submission with a clean blocked-claim ledger. No manual assembly required.
Valty is in design-partner and early-access stage. All financial figures are illustrative decision-support estimates with method, confidence, and limitation stated adjacent to the claim. No fabricated customers, no published pricing.