Cyber-insurance applications used to ask whether you had antivirus. They now ask twelve technical questions, and the honest answers decide both the premium and whether a claim is paid. This guide goes through the twelve, in the order they usually appear, and says what a truthful yes requires.
The rule throughout: answer what is true on the day you sign. An application is part of the policy. If a claim investigation finds that “yes, we use multi-factor authentication” meant “on two of the nine accounts”, the policy can be rescinded and the claim denied. That has happened to businesses smaller than yours.
The twelve questions
1. Do you use multi-factor authentication on email? The insurer means every mailbox, including the owner’s, the shared ones and the former employee’s that was never closed. A truthful yes requires MFA enforced for all users in Microsoft 365 or Google Workspace, not merely available. Time to get there: an afternoon, plus a week of reminding people.
2. Do you use MFA on remote access? Any way into your network from outside: VPN, remote desktop, the remote-control tool your IT provider uses. Open remote desktop on the internet is the single most common way ransomware gets into small businesses, and the insurer knows it. Yes means every remote path requires a second factor and nothing is reachable from the internet without one.
3. Do you use MFA on administrator accounts? The accounts that can change settings, reset passwords and read everyone’s mail. Yes means those accounts are separate from the daily accounts, have MFA, and are used only for administration.
4. Do you run endpoint protection on every device? Not the free antivirus that came with the laptop. The insurer means a managed product on every workstation and server, reporting to a console that someone watches. Yes means you can produce a list of devices and the date each last reported in.
5. Are your backups separated from your network and tested? The question behind the question: if ransomware encrypts everything, is there a copy it cannot reach, and does restoring from it actually work? Yes means an offline or immutable copy, and a restore test with a date in a log.
6. Do you filter email for phishing and malware? Yes means a filtering service in front of the mailboxes, with impersonation protection switched on, and a way for staff to report a suspicious message.
7. How quickly do you apply security patches? Insurers want critical patches on within days, not months. Yes means a patch schedule you can describe and a report showing what is current.
8. Are laptops and mobile devices encrypted? A lost laptop in an airport is a reportable breach unless the disk is encrypted. Yes means encryption turned on and the recovery keys stored somewhere other than the laptop.
9. Do you train staff on security? Yes means short, regular training with a record of who completed it, and ideally simulated phishing so the training is measured rather than assumed.
10. Do you have an incident response plan? A written one, with who to call, how to isolate a device, where the backups are and who talks to the insurer. One page is enough. Yes means it exists, people know where it is, and it was looked at in the last year.
11. Do you restrict and monitor vendor and third-party access? The bookkeeper’s remote login, the copier company’s portal, the practice-management vendor’s support access. Yes means each has its own account, MFA where possible, and gets removed when the relationship ends.
12. Do you keep logs, and for how long? Sign-in logs, admin changes, email rules created. Yes means audit logging is turned on in your cloud services and retained long enough to investigate a problem discovered a month after it started. In Microsoft 365 that is a setting, not a product.
The three answers that most often go wrong
MFA “in place” on some accounts. The owner has it, the shared mailbox does not, the former office manager’s account is still open without it. Insurers treat partial as no.
Backups that exist but were never restored. The backup job says success every night; the restore has never been tried; the first attempt is the day after the attack. Test it, and write down the date.
Remote desktop left open “just for the accountant”. One forgotten port forward on the firewall undoes everything else on the list.
The evidence pack to keep with the policy
- MFA report from Microsoft 365 or Google Workspace showing every user enforced
- Endpoint protection console export listing every device and last check-in
- Backup job history and the most recent restore test, with dates
- Email filtering policy summary, including impersonation protection
- Patch report for workstations and servers from the last thirty days
- Encryption status report for laptops
- Training completion record for the last twelve months
- The incident response plan, dated
- A list of vendor accounts and when each was last reviewed
- A screenshot showing audit logging is on and the retention period
What to do if several answers are no
Do not sign the application with a yes you cannot support. Fix the first five first: MFA on email, remote access and admin accounts, managed endpoint protection, and a tested backup. Those take a few weeks for most offices and move the premium more than anything else. Then answer honestly, with a short note on what is scheduled. Underwriters respond better to a dated plan than to an optimistic yes, and a dated plan does not void a claim.