As with most things in computer security this is mostly performed as a self-assessment. The insurer will provide a set of questions about things like backup pol

As with most things in computer security this is mostly performed as a self-assessment. The insurer will provide a set of questions about things like backup policies, access control, and encryption which you’re expected to answer. Unless it’s a ridiculously valuable policy they’re not going to get pentesters in to verify your answers, in the same way your home insurer doesn’t send someone round to check you really do have smoke detectors and locks on your front door.