Free Cyber Insurance Readiness Check

Will your business pass its cyber insurance application?

Insurers now ask detailed security questions before they quote or renew — and missing controls can mean higher premiums, exclusions or no coverage at all. Answer 18 questions drawn from real applications and see where you stand, what to fix first and what to show your broker. Nothing is sent anywhere unless you choose to.

Answer

The security questions that show up on cyber insurance applications and ransomware supplements.

Score

The controls insurers treat as must-haves count most. Your grade updates as you go.

Fix

Get the gaps to close before your renewal, most important first — and print or save them for your broker.

MFA & admin access

The first thing most insurers ask about. Missing MFA is a common reason for higher premiums, exclusions or a declined application.

Question 1 · Insurer must-have

Is MFA required for every user’s email, including on phones and webmail?

What insurers want to seeEvery mailbox in Microsoft 365 or Google Workspace, with legacy sign-in methods that skip MFA turned off.

If not, fix itTurn on MFA for every mailbox and block legacy authentication, so a stolen password alone can’t open email.

Our answer Yes Partly / not sure No

Question 2 · Insurer must-have

Is MFA required for all remote access — VPN, remote desktop and cloud apps?

What insurers want to seeAnyone connecting from outside the office proves who they are with a second factor.

If not, fix itRequire MFA on the VPN, remote desktop gateways and every cloud app that holds company data.

Our answer Yes Partly / not sure No

Question 3 · Insurer must-have

Is MFA required for every administrator account, including backup and email admin consoles?

What insurers want to seeDomain admins, Microsoft 365 or Google admins, firewall and backup consoles.

If not, fix itPut MFA on every privileged account and admin console — attackers go after these first.

Our answer Yes Partly / not sure No

Question 4 · Important

Do staff work without administrator rights, with admin accounts kept separate?

What insurers want to seeEveryday accounts can’t install software; IT uses separate admin accounts only for admin work.

If not, fix itRemove everyday admin rights and give IT separate, MFA-protected admin accounts.

Our answer Yes Partly / not sure No

Question 5 · Important

Is vendor and outside remote access controlled — named accounts, MFA, and on only when needed?

What insurers want to seeSoftware vendors and outside IT sign in with their own MFA-protected accounts, and their remote-access tools aren’t left running all the time.

If not, fix itGive each vendor a named, MFA-protected account, turn off always-on remote tools and log every session.

Our answer Yes Partly / not sure No

Devices & patching

Endpoint detection and response, timely patches, no unsupported systems and encrypted laptops.

Question 6 · Insurer must-have

Is endpoint detection and response (EDR) on every computer and server, watched 24×7?

What insurers want to seeEDR such as SentinelOne on 100% of endpoints, with a security team responding to alerts around the clock.

If not, fix itDeploy managed EDR on every endpoint and server, monitored by a 24×7 SOC.

Our answer Yes Partly / not sure No

Question 7 · Important

Are critical security patches installed within 30 days — and urgent ones within days?

What insurers want to seeOperating systems, browsers and common apps patched on a schedule, with anything overdue tracked.

If not, fix itAutomate patching for operating systems and third-party apps, and track anything that falls behind.

Our answer Yes Partly / not sure No

Question 8 · Important

Are you free of unsupported (end-of-life) systems and software?

What insurers want to seeNo Windows versions, servers or apps that no longer get security updates — or they’re isolated from the network.

If not, fix itReplace or isolate unsupported systems; insurers often ask about them by name.

Our answer Yes Partly / not sure No

Question 9 · Insurer must-have

Is remote desktop (RDP) closed to the internet?

What insurers want to seeNobody can reach a computer’s remote desktop directly from the internet; remote access goes through a VPN or gateway with MFA.

If not, fix itClose any internet-exposed remote desktop and move remote access behind an MFA-protected VPN or gateway.

Our answer Yes Partly / not sure No

Question 10 · Insurer must-have

Are firewalls, VPNs and other internet-facing devices patched within days of an urgent fix?

What insurers want to seeEdge devices — firewalls, VPN gateways and remote-access appliances — get critical updates quickly, and ones that no longer receive updates are replaced.

If not, fix itPut internet-facing devices on a fast patch cycle and replace any that are past end of support — attackers scan for them first.

Our answer Yes Partly / not sure No

Question 11 · Good practice

Are laptops encrypted and can a lost one be wiped remotely?

What insurers want to seeBitLocker or FileVault on every laptop, managed centrally.

If not, fix itEncrypt every laptop and enroll devices in management so a lost one can be locked and wiped.

Our answer Yes Partly / not sure No

Backups & recovery

Backups ransomware can’t reach, and proof that you can restore from them.

Question 12 · Insurer must-have

Are backups kept offline, immutable or otherwise out of ransomware’s reach?

What insurers want to seeA copy that can’t be encrypted or deleted from your network, with separate credentials and MFA.

If not, fix itKeep an off-site or immutable backup copy that ransomware and stolen admin passwords can’t reach.

Our answer Yes Partly / not sure No

Question 13 · Important

Have you tested restoring from backup in the last six months?

What insurers want to seeAn actual restore of files or a server, with the time it took written down.

If not, fix itTest restores on a schedule and record how long recovery takes.

Our answer Yes Partly / not sure No

Email, people & payments

Phishing and payment fraud drive a large share of claims.

Question 14 · Important

Do you have advanced email filtering and SPF, DKIM and DMARC set up?

What insurers want to seeFiltering for malicious links, attachments and impersonation, plus domain records that stop spoofing.

If not, fix itAdd advanced email security and move your domain’s DMARC policy to enforcement.

Our answer Yes Partly / not sure No

Question 15 · Important

Does everyone get security awareness training every year and phishing tests every quarter?

What insurers want to seeCompletion and phishing results tracked, so you can show them.

If not, fix itStart annual security awareness training with quarterly simulated phishing.

Our answer Yes Partly / not sure No

Question 16 · Insurer must-have

Do you confirm every new payment request or change in bank details by phone?

What insurers want to seeA call-back to a number you already have, never one in the email — and a second approver for large payments.

If not, fix itWrite a payment verification procedure: call-back on a known number and dual approval above a set amount.

Our answer Yes Partly / not sure No

Monitoring & response

Someone watching around the clock, and a plan for the day something gets through.

Question 17 · Important

Are security logs collected and watched by someone 24×7?

What insurers want to seeA managed SIEM or security operations center reviewing alerts at night and on weekends.

If not, fix itGet 24×7 monitoring: a managed SIEM with a SOC that reviews and acts on alerts.

Our answer Yes Partly / not sure No

Question 18 · Important

Do you have a written incident response plan, tested in the last year?

What insurers want to seeWho to call first — including your insurer’s claims line — and what to do in the first hour.

If not, fix itWrite a one-page incident response plan and run a tabletop exercise with leadership once a year.

Our answer Yes Partly / not sure No

All set? See your readiness grade and what to fix before renewal.

A · 78+Ready — keep the evidence handy

B–CClose the gaps before you apply

DExpect hard questions or higher premiums

FCoverage at risk — start now

Already insured? Compare what your policy covers with a cyber warranty, check your wider security with the cyber risk self-check, or see how our vCISO handles insurance applications every year.

Questions are based on public cyber insurance applications and guidance from Tokio Marine HCC, AXIS, Corvus and Coalition, Marsh’s 12 Key Cyber Controls and the New York DFS Cyber Insurance Risk Framework. Every carrier’s application is different; this check is for planning, not a quote or a coverage decision.

Cyber insurance questions

What security controls do cyber insurers ask about?

Most applications and ransomware supplements ask about multifactor authentication (for email, remote access and administrator accounts), endpoint detection and response, backups that ransomware can’t reach, patching and unsupported systems, email security, security awareness training, how you verify payment requests, and whether you have an incident response plan.

Can we be denied coverage for missing MFA?

It happens. Many carriers treat MFA on email, remote access and privileged accounts as a requirement, and missing it can lead to a declined application, a ransomware exclusion or a higher premium. Requirements vary by carrier, so ask your broker.

What happens if we answer the application wrong?

Applications are signed statements. If a control you said was in place wasn’t, a carrier may dispute a claim. Answer accurately, keep evidence for each control, and fix gaps before you sign rather than after.

How do we prove our controls to the insurer?

Keep evidence: MFA enrollment reports, EDR coverage by device, backup and restore-test logs, training completion and phishing results, and a written incident response plan. As part of Managed Care, your vCISO keeps this ready for every renewal.

Is cyber insurance the same as a cyber warranty?

No. Insurance is a policy you buy from a carrier; a cyber warranty is financial protection tied to your provider’s security services. Many businesses have both — see our cyber insurance vs. cyber warranty guide.

Will your business pass its cyber insurance application?

Answer

Score

Fix

MFA & admin access

Is MFA required for every user’s email, including on phones and webmail?

Is MFA required for all remote access — VPN, remote desktop and cloud apps?

Is MFA required for every administrator account, including backup and email admin consoles?

Do staff work without administrator rights, with admin accounts kept separate?

Is vendor and outside remote access controlled — named accounts, MFA, and on only when needed?

Devices & patching

Is endpoint detection and response (EDR) on every computer and server, watched 24×7?

Are critical security patches installed within 30 days — and urgent ones within days?

Are you free of unsupported (end-of-life) systems and software?

Is remote desktop (RDP) closed to the internet?

Are firewalls, VPNs and other internet-facing devices patched within days of an urgent fix?

Are laptops encrypted and can a lost one be wiped remotely?

Backups & recovery

Are backups kept offline, immutable or otherwise out of ransomware’s reach?

Have you tested restoring from backup in the last six months?

Email, people & payments

Do you have advanced email filtering and SPF, DKIM and DMARC set up?

Does everyone get security awareness training every year and phishing tests every quarter?

Do you confirm every new payment request or change in bank details by phone?

Monitoring & response

Are security logs collected and watched by someone 24×7?

Do you have a written incident response plan, tested in the last year?

Close to ready, with a few gaps.

What to fix before your renewal

Email me my results

Want help with your application?

Free on-site IT review

Cyber insurance questions

Obsessive about service. Relentless about the details.