Identify the systems and data at risk
List point-of-sale, inventory, payroll, payment, customer, employee, and operational systems. Explain what information the business stores, where it resides, and which outside vendors can access it.
Show how access and recovery are managed
Describe authentication, backups, software updates, employee access, payment controls, incident response, and any prior cyber or privacy event. Note which safeguards are operated by a vendor and which remain the insured's responsibility.
Cyber questions to resolve before submission
- Which systems would interrupt sales or operations if they became unavailable?
- What customer, employee, payment, or regulated information does the business retain?
- How are access, backups, vendor permissions, and incident response tested?
What CARMA wants the submission to explain
These details help the team understand the account and identify the next useful question. They do not establish eligibility or available terms.
- Identify the point-of-sale, inventory, payment, payroll, customer, and operational systems the business relies on.
- Describe the information retained, vendor access, authentication, backups, updates, and incident response.
- Explain prior privacy, ransomware, funds-transfer, or system events and the corrective action taken.
Records for a cyber review
- System and vendor list, including point-of-sale, inventory, payment, and payroll providers
- Summary of data handled, access controls, backups, and incident-response procedures
- Prior cyber, privacy, funds-transfer, or ransomware events and current coverage details
Can CARMA consider this account?
CARMA confirms program fit, licensing, state availability, coverage options, and market interest for each account. This guide does not promise eligibility, terms, pricing, or placement.