What Lenders Ask About Cyber Before Credit Committees

A credit review used to be about cash flow, collateral and covenants. Increasingly, a lender's questionnaire also asks whether the borrower can survive a cyber event, because an outage or a breach can interrupt the cash flow the loan depends on.

There is no single standard for these questions. They vary by lender and by deal. But the same four themes keep showing up: what has happened before, what framework the program follows, what insurance sits behind it, and whether recovery has been proven.

The CFO who gets the questionnaire usually does not own the answers. The goal of this post is to make sure the answers exist, in writing, before the credit committee date is set.

TLDR

• Lender cyber questions cluster around four themes: incident history, framework, insurance and recovery evidence.

• Answers that cite a document beat answers that cite a person's confidence.

• Gaps found before the questionnaire arrives are cheap to fix; gaps found during it cost time and terms.

• The CFO should own the question list and assign each answer to a named owner.

• No standard defines the list, so ask the lender early what form they expect.

Why a lender cares

A lender is underwriting the borrower's ability to keep operating. A ransomware outage that halts shipping for two weeks, or a breach that triggers customer losses, can change covenant compliance faster than a bad quarter.

That is the logic behind the questions. They are not an audit of the security program. They are a test of whether the borrower knows its own exposure and can show it.

The four themes, and what a good answer looks like

The questions below reflect what lenders and underwriters commonly request in practice. Treat them as a working list, not a standard. The evidence column is the part that makes an answer credible.

Theme	Typical question	Evidence worth having ready
Incident history	Any material cyber incident in the past three years, and what changed afterward?	Incident log summary; post-incident review; list of fixes closed
Control framework	Which framework does the program follow, and who assessed it?	Latest assessment summary against the framework; remediation plan with dates
Insurance	What cyber coverage is in force, with what limits and conditions?	Current policy declarations; list of conditions the policy requires
Recovery evidence	When did you last restore critical systems, and how long did it take?	Dated restore test result against the stated recovery objective

The table is a structure for your own preparation. The cells are generic; yours should name systems, dates and owners.

Where answers usually fall apart

Three weak spots come up again and again.

• Framework claims without an assessment. Saying the program follows NIST is not the same as showing where it stands. NIST's Cybersecurity Framework 2.0 describes outcomes; it does not certify anyone.
• Insurance conditions nobody tracked. Policies often require specific controls. If a required control lapsed, the coverage on paper may not match the coverage in practice. The renewal checklist for boards covers the conditions worth confirming.
• Recovery claims with no test date. A stated recovery time that has never been tested is a hope. A lender will ask when it was last proven.

Who owns the answers

Give the CFO the question list and make each row someone's job. The CISO or security lead usually owns the framework and incident rows. Risk or the CFO's office owns insurance. IT operations owns recovery evidence.

Have one reviewer read the whole set for consistency before anything goes out. An answer that contradicts another row, or last year's questionnaire, creates more questions than it closes.

Frequently asked questions

Do lenders require a specific cybersecurity framework?

There is no universal requirement. Lenders differ by deal, so ask which framework or evidence they expect. NIST CSF, ISO 27001 and CIS Controls are common reference points, but the lender's own questionnaire sets the bar.

What should we say about past incidents?

Be accurate and complete, then show what changed. A short incident summary with closed fixes reads better than silence or a vague answer. Have counsel review the wording.

Is cyber insurance enough on its own?

No. Insurance transfers part of the financial loss, but a lender also wants to see that the business can keep running. Policy conditions also matter, because coverage can depend on controls being in place.

When should we prepare these answers?

Before a financing is on the calendar. Fixing a gap in advance is cheap. Fixing it while a credit committee waits can affect timing or terms.

A Defensible Next Step

Pull the last lender or insurer questionnaire you received and answer it today, with a document behind every row. Wherever you cannot point to one, you have found the work to do before the next review. Book a Decision-Clarity Call to turn that gap list into a plan.