If you’ve ever filled out a cyber insurance application or renewal, you know the feeling: a page of security questions, a few “I think so” answers and a worry that one wrong box could cause a problem later. The questions are surprisingly consistent. Once you know them, you can prepare long before the renewal arrives.
This isn’t insurance advice. We’re an IT provider, not an insurer or an agent, and every insurer’s form is different. What follows are common insurer questions, why they tend to be asked and what a good answer usually looks like. Your insurance agent can tell you what your own policy requires.
Not sure how you’d answer? Take the free readiness check. It takes about three minutes and there’s no sign-up.
Sign-in and access
- Is multi-factor authentication (MFA) required for every email account, including administrators? Stolen email passwords are one of the most common ways in, and this is one of the questions asked most often. Start with our MFA rollout guide.
- Is MFA required for remote access, such as a VPN, remote desktop and cloud admin consoles? Remote access is a favorite target.
- Do administrators use separate accounts, and is the number of administrators kept small? An everyday account that is also an administrator is one phished password away from losing everything.
- When someone leaves, is their access shut off the same day? Old accounts that stay active are an easy way in.
Protection
- Do all computers and servers run current endpoint protection that someone monitors? A free antivirus nobody checks usually isn’t enough.
- Is email filtered for phishing and malicious attachments beyond the basic spam filter? Most attacks start with an email. Our free Email Security Checker shows whether others can send email pretending to be your business.
- Are operating systems and key software updated on a schedule, with nothing still running unsupported software?
- Is the network protected by a business-grade firewall with current firmware?
Backups and recovery
- Are backups kept where ransomware can’t reach them (offline, immutable or in a separate cloud account)? Ransomware often encrypts connected backups too.
- Has someone tested a restore in the last 12 months? A backup you’ve never restored is a hope, not a plan. See our guide to backup and disaster recovery.
- Is your cloud email and file data backed up separately from Microsoft or Google? They keep your data available, but that isn’t the same as a backup.
People and plans
- Do staff get security awareness training at least once a year, including simulated phishing? People are the most common way in.
- Is there a written incident response plan: who to call (IT, your insurer, your bank, a lawyer) and what not to do?
- Is a payment or bank-detail change confirmed by a second person, or by a call to a known number, before money moves? Fake-invoice and wire fraud are among the most common and most costly losses.
How to use this list
- Answer honestly. An application that overstates your protection can cause trouble when you need to make a claim. If the answer is “not yet,” that’s the starting point for a fix.
- Fix the quick wins first. MFA, a payment-confirmation rule and a written incident plan usually take hours, not weeks.
- Keep proof. A short document saying what’s turned on, where and since when makes the next renewal much easier.
- Talk to your agent. Ask which questions your own policy form asks, and whether any controls are required.
A quick way to see where you stand
Our free Cyber Insurance Readiness Check walks through these 14 questions, scores how ready you are and lists what to fix first, with why insurers ask and about how long each fix takes. You can print the report or email it to yourself.
If you’d like help closing the gaps, we’ll go through them with you as part of a free IT assessment.
Leave a Reply