1. Multifactor authentication
Typical question"Is multifactor authentication required for all email access, all remote network access, and all administrative or privileged accounts, including vendor and service accounts?"
What the underwriter is assessing: whether a stolen password alone can reach email, the VPN, or an admin console. MFA scope is among the most heavily weighted answers on the form because credential-based intrusion remains the leading path into ransomware and funds-transfer losses.
Evidence that answers it: Conditional Access or equivalent policy exports showing enforcement for all users and all admin roles, the list of excluded accounts with justification, and confirmation that legacy authentication protocols that bypass MFA are blocked.
Common trap: answering yes because MFA is "enabled" for the tenant. Enabled is not enforced. Excluded break-glass accounts, service accounts, legacy authentication protocols, and per-user exceptions all make a blanket "yes, all accounts" answer false while the dashboard still says MFA is on.
2. Backup and recovery
Typical question"Are backups of critical systems maintained offline, offsite, or in an immutable state, encrypted, and tested for restoration within the last 12 months?"
What the underwriter is assessing: whether a ransomware event becomes a restore project or a ransom negotiation. The question is really three: can the attacker reach and encrypt the backups, do the backups actually cover the systems that matter, and has anyone proven a restore works.
Evidence that answers it: backup configuration showing immutability or segregation from production credentials, the coverage list of protected systems, and a dated restore test record from the last 12 months.
Common trap: equating "backups run nightly" with what was asked. Backups reachable with the same domain admin credentials an attacker would hold are not segregated, and a restore that has never been tested is an assumption, not a control.
3. Endpoint detection and response
Typical question"What percentage of endpoints and servers are covered by an EDR solution, and is it monitored 24/7 by internal staff or a managed provider?"
What the underwriter is assessing: detection speed. EDR coverage is a proxy for whether an intrusion is caught in hours or discovered weeks later as encryption. The percentage matters because attackers pivot to the unmonitored machines.
Evidence that answers it: an onboarding or coverage report from the EDR console reconciled against the full device inventory, plus the monitoring arrangement (SOC, MDR contract, or internal on-call).
Common trap: reporting the percentage of known devices. Coverage measured against the EDR console's own inventory is circular; servers, legacy machines, and unmanaged endpoints that were never onboarded do not appear in the denominator.
4. Privileged access
Typical question"How many users hold domain, global, or equivalent administrative privileges, and are privileged accounts separated from daily-use accounts and reviewed periodically?"
What the underwriter is assessing: blast radius. Each standing admin account is a full-environment compromise waiting on one phish. The count, separation from daily-use identities, and review cadence together indicate whether privilege is managed or accreted.
Evidence that answers it: a current export of privileged role assignments, evidence of separate admin identities, just-in-time elevation if used, and the record of the last access review with removals actioned.
Common trap: counting only the admins you remember. Role assignments accumulate: former staff, vendor accounts, and "temporary" grants from past projects routinely push the real number well past the answer on the form.
5. Email security
Typical question"Do you use email filtering and authentication controls such as SPF, DKIM, and DMARC, and do you conduct phishing awareness training?"
What the underwriter is assessing: exposure to the two dominant loss drivers that start in the inbox: business email compromise and phishing-delivered malware. Authentication records also determine how easily your own domain can be spoofed against your customers and payment counterparties.
Evidence that answers it: the published SPF, DKIM, and DMARC DNS records with the DMARC policy value, anti-phishing and filtering policy configuration, and dated training or simulation records.
Common trap: a DMARC record set to p=none. A monitoring-only policy exists but enforces nothing; answering "DMARC implemented" while spoofed mail still delivers overstates the control the underwriter thinks it is pricing.
6. Incident response
Typical question"Do you have a written incident response plan, has it been tested in the last 12 months, and how long are security logs retained?"
What the underwriter is assessing: claim severity. Two otherwise identical intrusions produce very different losses depending on whether the response is rehearsed and whether logs exist to scope the breach. Thin logging inflates forensic cost and can force worst-case breach notification.
Evidence that answers it: the plan document with an owner and revision date, a record of the last tabletop or live exercise, and the configured log retention periods for identity, email, and endpoint telemetry.
Common trap: attesting to a plan that exists as a document and nothing else. A plan no one has exercised, with contacts that have left and retention defaults never raised, satisfies the letter of "written" and fails everything the question is for.