Cyber Insurance Readiness Check

Does every employee need a one-time code or app approval, not just a password, to check company email?

Multi-factor authentication on email is among the controls carriers ask about most, because stolen email passwords are a common way attacks begin.

Is a one-time code or app approval required to connect remotely to your network, such as through VPN or remote desktop?

Remote access is a top ransomware entry point; carriers require MFA on every VPN and remote-desktop connection before binding coverage.

Do IT administrator and other privileged accounts require a one-time code or app approval beyond a password to log in?

Privileged accounts control the whole network; unprotected admin access is one of the three controls carriers grade as a hard minimum.

Are administrator-level permissions limited to only the few people who truly need them, rather than shared broadly?

Privileged access management (least privilege) limits how much damage one stolen password or phished employee can cause.

Is endpoint detection and response (EDR) software installed on every computer and server, not just some devices?

Carriers ask whether EDR covers every endpoint, including servers. Gaps in coverage can affect whether you qualify and how a claim is handled.

Are security alerts from your computers and servers actively watched, with someone able to respond at any hour?

Insurers' logging and monitoring controls expect alerts to be watched and acted on around the clock; unwatched alerts give attackers time.

Are security updates (patches) applied to computers, servers, and software on a regular, defined schedule?

Carriers expect critical patches to be applied promptly on a defined schedule; unpatched systems are a common way attackers get in.

If remote desktop (RDP) is used, is it blocked from being reached directly over the public internet?

Exposed RDP is one of the most common ransomware entry points; carriers flag it as a standalone hardening question.

Do you keep at least one backup copy offline or immutable, disconnected from your regular network?

Attackers target connected backups first; carriers treat an offline or immutable copy as required before they will pay a ransomware claim.

Have you tested restoring data from backup within the last 12 months to confirm it actually works?

There is no point having backups that are unavailable or incomplete when needed; insurers treat regular restore testing as essential, not optional.

Do your backups cover all critical business systems and data, not only files on individual computers?

Partial backups leave core operations unrecoverable; carriers ask whether backup scope covers critical systems, not just individual user files.

Do you use email filtering software that blocks or flags suspicious links and attachments before they reach inboxes?

Phishing is a common way ransomware starts; email filtering that blocks malicious links and attachments is a named carrier control.

Are laptops and mobile devices holding company data encrypted, so data is unreadable if a device is lost or stolen?

Encryption protects data even if hardware disappears; government guidance specifically recommends disk encryption for laptops and mobile devices.

Do you require a follow-up phone call to a known number before changing any vendor's payment or bank account details?

Carrier applications ask this directly. Calling a known number before changing payment details helps stop fraudulent payment-change requests.

Do you have a written incident response plan describing exactly what to do first if you suspect a cyberattack?

A documented incident response plan, reviewed by leadership, is a named carrier control and helps your team act quickly and in the right order.

Has your incident response plan been tested with a practice run (tabletop exercise) in the last 12 months?

An annual tabletop exercise is a recommended practice so the response team knows its role; an untested plan often fails under real pressure.

Do all employees receive recurring security awareness training, including simulated phishing tests, at least once a year?

Carriers ask how often phishing training runs; annual or more-frequent simulated phishing is a named control tied to fewer breach claims.

Do you keep logs of network and security activity, retained for at least a few months, not just a few days?

Guidance recommends logs stay accessible for at least three months and backed up for a year, to support investigation and claims.

If you use an outside IT provider (MSP), do you know what security controls they apply to your systems?

MSP compromise can expose every client at once; cyber applications specifically ask whether an MSP is used and which one.

Do you review the cybersecurity practices of vendors or suppliers who can access your network or data?

A breached vendor with access to your network or data can expose your business too, so carriers ask how you manage vendor risk.

Do you keep track of any outdated or unsupported (end-of-life) software or hardware still in use?

Unsupported systems stop receiving security patches and become known, easy targets; tracking and replacing them is a named carrier control.

Do you review your cyber insurance coverage and limits at each renewal to make sure they still match your risk?

Coverage needs change as a business grows; regulators recommend discussing current risk and policy fit with your agent at every renewal.