Somewhere in your renewal file is a document that says your company requires multi-factor authentication on all remote access, tests its backups, and maintains an incident response plan. Somebody signed it. It is likely nobody has checked whether it is still true.
That document is not a form. It is a set of representations the insurer relies on when pricing and issuing the policy, and if a claim reveals that a warranted control was absent, the insurer has grounds to reduce or decline it. You will discover this at the worst possible moment, which is the entire problem.
The questions that carry the most weight
The application language varies by carrier, but the controls that recur are consistent, and they are the ones worth verifying properly.
Multi-factor authentication on remote access, email and privileged accounts. The word that causes trouble is "all." One service account, one legacy VPN, one vendor connection into the plant, and the warranty is imperfect.
Backups that are tested and separated. Not "we have backups." Tested, meaning somebody has restored from them recently and recorded it, and separated, meaning an attacker with domain access cannot encrypt them too.
Endpoint detection deployed everywhere. Everywhere includes servers, includes the machine on the line running an old operating system, and includes the laptop the maintenance contractor brings.
Privileged access management. How many accounts hold domain admin, who reviews the list, and when they last did.
An incident response plan. One somebody has read, that names people, and that has been exercised at least on paper.
Where manufacturers get caught
Three patterns come up repeatedly.
The plant floor is excluded from the answer without anybody meaning to exclude it. The person completing the form describes the corporate environment accurately, and the equipment on the line is simply not in their mental model.
Vendor remote access is forgotten. Equipment manufacturers often hold standing connections into plant systems, established years ago, outside the identity system entirely.
Backups of the things production actually depends on are untested. Corporate file shares are covered. The historian, the programme file store and the licence server are frequently not.
Read the policy against your own risks, not just the limit
The other half of this is coverage, and the headline limit is the least useful number in the document.
Cyber policies pay against sublimits, retentions and waiting periods. A policy with a healthy aggregate can carry a business interruption sublimit that covers a fraction of a serious plant outage, and a waiting period longer than the outage you are most likely to have, which means it never triggers at all.
The useful exercise is to take your two or three most plausible loss scenarios, cost them honestly, and read the schedule against them line by line. That is a different question from "are we insured," and it is the one that determines whether the policy does anything for you.
Do this in the right order
Before the renewal, verify the controls you are about to warrant, and correct the answers where they are wrong. An honest "no, and here is our remediation date" affects your premium. A false "yes" affects whether you get paid.
Then read the schedule against your actual exposure and decide whether the structure matches the risk.