The Gap

There's a Space Between the Broker Letter and the Big 4 Assessment.

When your broker flags AI questions on the draft questionnaire 60 days before renewal, you have four options — and three of them create new problems:

✗

Answer from memory — creates bad-faith exposure if you're wrong and file a claim

✗

Have your broker write a narrative letter — carriers discount it; it's not evidence

✗

Engage a Big 4 firm for a $25K–$60K assessment — designed for SOC 2, not insurance; too slow for a 60-day window

✓

CIPU — evidence-backed, shaped specifically for the underwriting moment, delivered in the renewal window

Who This Is For

CFOs and COOs at 50–300 Employee Companies.

You own the insurance relationship. You feel the premium impact directly. And your broker just sent you a questionnaire with an AI section you can't answer accurately without evidence you don't have organized.

CIPU is built for regulated verticals where both insurance and compliance obligations create overlapping requirements: healthcare, legal, financial services, accounting, real estate.

Healthcare Legal Financial Services Accounting Real Estate

The Assessment

A Three-Section Rubric Built for Underwriters.

Not a generic security framework. Calibrated to the actual criteria carriers evaluate — including the AI sections most assessments don't touch.

🔒

Section 1 — Universal Cyber Hygiene

Baseline controls every carrier expects regardless of vertical or AI exposure: MFA enforcement, endpoint protection, patch management, backup architecture, incident response documentation, and privileged access controls.

Required for any tier of insurability

Scored 0–2 per item, weighted by carrier priority

🤖

Section 2 — AI Exposure & Governance

The section your questionnaire now includes and most firms can't answer with evidence. AI tool inventory, acceptable-use policy, training and data governance, vendor AI risk, output validation, AI-specific incident response, and red-team posture.

Covers ISO AI exclusions CG 40 47, CG 40 48, CG 35 08

Maps to carrier-specific AI Riders

⚖️

Section 3 — Vertical Compliance Overlay

Vertical-specific requirements layered on top of the baseline. Healthcare maps HIPAA and ePHI-AI interaction controls. Legal maps ABA Model Rules 1.6 and 5.3, privilege risk, and client data governance. More overlays in development.

Healthcare operational now

Legal, insurance, accounting, real estate in development

📊

Scoring → Insurability Tier

Each item scored 0–2. Section weights applied. Total maps to four tiers: Insurable / Conditional / At Risk / Likely Denial. Downgrade rules apply when any single section falls below threshold — a strong Section 1 doesn't rescue a failing Section 2.

The Differentiator

Carriers Aren't Converging. They're Diverging.

Generic "AI exclusions are coming" assessments give you the same output regardless of who your carrier is. That's not useful when carriers are moving in five different directions.

CIPU is calibrated to your carrier's actual position. The report names which pattern applies to your carrier and tailors recommendations accordingly — so the remediation priorities in your report are the ones that matter for your renewal, not someone else's.

Affirmative Expansion

Coalition, Embroker, AXA XL — explicitly covering AI losses; stricter questionnaires with higher evidence bar.

Sublimits

Beazley, QBE — AI losses covered but sublimited; posture documentation influences sublimit negotiation.

Exclusion

AIG, Hamilton — AI losses excluded by endorsement; report identifies what's at risk under current terms.

Underwriting Tightening

Westfield — baseline controls requirements are stricter; Section 1 posture is a renewal gating factor.

Acquisition / Consolidation

Zurich/Beazley — position is still resolving; report flags what to clarify with your broker before submission.

The Deliverable

A Report You Attach to Your Submission.
Not Advice. Evidence.

A concrete artifact — not a slide deck, not a consulting memo. Built to put in front of your broker, your underwriter, or your board.

📄

PDF Assessment Report

Cover, executive summary, score-at-a-glance, per-section item tables with documented narratives, section summaries, top-5 remediation priorities, and an attestation block. Formatted for underwriter review.

🗂️

Evidence Bundle (ZIP)

Includes the PDF report, a JSON evidence manifest with SHA-256 chain-of-custody for all supporting documentation, assessment summary, and README. Defensible if challenged on a claim.

🗺️

Remediation Roadmap

Top-5 prioritized remediation actions ranked by coverage impact and implementation complexity. What to address before submission, what can wait, and rough effort for each.

💬

Broker Briefing (Optional)

Live readout with your broker to walk through findings and support the renewal conversation. Available as an add-on. Carrier-calibrated — we'll speak your carrier's language.

🔍

Human Review on Every Report

The assessment is AI-assisted — scored and narrated by a structured AI pipeline. Every output is reviewed and signed off by a Layer8 assessor before delivery. No report ships without human sign-off. That's not a marketing claim; it's enforced at the system level.

Why Layer8

Built by People Who've Implemented the Controls Carriers Are Looking For.

The CIPU methodology was developed by the same team that built and operated HIPAA, SOC 2, and PCI compliance frameworks at CVS Health and Aetna. We understand what underwriters want to see because we've had to produce that documentation — in regulated environments where the consequences of getting it wrong were higher than premium pricing.

CVS Health

HIPAA Security Rule implementation and SOC compliance infrastructure at enterprise scale

Aetna

Enterprise security architecture and compliance programs across a regulated healthcare environment

35+ years

Enterprise technology and security leadership — healthcare, financial services, and AI sectors

How It Works

Three Steps. Fits the Renewal Window.

Step 1

Scoping Call

30 minutes. We review your current policy, your renewal date, your carrier, and what's on the draft questionnaire. We confirm whether CIPU is the right engagement and scope the work. No commitment required.

Step 2

Assessment

Structured interviews, documentation review, and technical verification across the three rubric sections. Calibrated to your carrier's position. Typically 2–3 weeks depending on organization size and documentation availability.

Step 3

Report & Readout

PDF report and evidence bundle delivered with a live readout. Remediation priorities reviewed. Application language reviewed. You leave with a defensible submission artifact and a clear list of what to remediate before renewal.

Fixed-fee engagement. Single-point-in-time by default; annual recurrence available at a reduced rate.

Questions

Common Questions.

Is this the same as a SOC 2 assessment? +

No. SOC 2 is built for vendor diligence — it tells your customers that your controls are reliable. CIPU is built for the underwriting moment — it tells your carrier that the controls you attested to on your application actually exist and are correctly configured. Different output shape, different audience, different stakes.

My renewal is in six weeks. Is there time? +

Possibly. The assessment takes 2–3 weeks for most organizations in the target range. We can start within days of a signed engagement. Call us now — the scoping conversation is 30 minutes and free. If the timeline doesn't work, we'll tell you on the call.

We already have a GRC platform (Vanta, Drata, Secureframe). Do we need this? +

Those platforms produce outputs shaped for sales and vendor diligence — they help you win customers, not satisfy underwriters. The artifact they produce doesn't map to the ISO AI exclusions or carrier-specific AI Riders your questionnaire now references. CIPU produces a different output, for a different moment, built to a different standard.

Start with a Scoping Call.

30 minutes. We'll review your renewal timeline, confirm whether CIPU is the right fit, and scope the work. No commitment required.

Schedule a Conversation →

[email protected] · 404-642-7589

Your Insurer Is Asking About AINow. Can You Prove Your Answers?