Cyber insurance application questions, one page at a time

Carriers ask the same things in different words. These pages take each question as it is actually worded on an application, explain what the underwriter is measuring, and show where the answer lives in Microsoft 365, Entra ID, and Azure so you can prove it instead of recalling it.

The questions below are normalised from the control topics that recur across US cyber application and ransomware supplemental forms, and are written in our own wording. No carrier form is republished. Wording differs by carrier; the underlying question does not, so each page is written against the normalised question and notes where carriers ask it more narrowly or more broadly.

Three states, not two

An answer is verifiable when the live configuration of your tenant settles it, partly verifiable when the tenant settles part of it and a process or a system we do not read settles the rest, and attested when no technical reading can settle it and an authorised signer has to stand behind it. Knowing which of the three you are in, before you sign, is the whole exercise.

Sections

6 questions

Multi-factor authentication

verifiedIs multi-factor authentication enforced on all email access? partialIs MFA enforced on all remote access (VPN, RDP, remote network admin)? verifiedIs MFA enforced on all privileged / administrative user accounts? partialIs MFA enforced on cloud provider (AWS / Azure / GCP) management consoles? verifiedWhat secondary factor method is used for MFA (SMS / Authenticator / Hardware key / Biometric)? partialIs multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?

Access control and privilege

partialDoes the Applicant utilize a Privileged Access Management (PAM) tool? partialHow many domain and service accounts are in the Domain Admin Group? verifiedAre all accounts associated with legitimate processes or current users (no orphaned/stale)? partialIs access restricted on a least-privilege basis to network, Personal Information, and Critical Information? verifiedAre administrator privileged access activities audited? verifiedAre changes to administrator accounts reported automatically? verifiedAre users able to access email through a non-corporate (BYOD/personal) device? partialDoes the use and distribution of administrator and privileged access require senior management approval? attestedAre wireless connections from untrusted devices allowed, and if so, are they on a separate network? attestedDoes the Applicant use a password manager to maintain master/privileged passwords used to access client systems and IT infrastructure? attestedAre master/privileged passwords used to access client systems and IT infrastructure unique and not reused? partialDoes the Applicant enforce a strong password policy (complexity, periodic rotation, and account lockout after repeated failed attempts)?

Backup and recovery

attestedAre there procedures and tools to back up sensitive data and critical systems? partialAre backups kept offline (disconnected) or immutable / air-gapped? partialAre backups encrypted? partialAre backups protected by MFA? partialAre backups secured with different access credentials from administrator credentials? attestedHave you tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months? attestedAre backups tested for malware-free integrity prior to restoration? attestedEstimated time to restore essential functions in widespread ransomware attack? partialHow frequently is critical data backed up? partialWhere are backups stored (on-prem / offsite / offline / MSSP / cloud)? partialIf backups are encrypted, are encryption keys stored offline? partialCan workstations be reimaged in bulk from a controlled operating system image?

Endpoint protection and patching

partialIs endpoint detection & response (EDR) deployed with central monitoring? partialIs next-generation antivirus (NGAV) deployed on all endpoints? partialWhat percentage of endpoints have EDR deployed? partialDoes the Applicant use any operating system, hardware or software that is no longer supported / End-of-Life? partialHow frequently is software updated, vulnerabilities patched, unnecessary services disabled? partialWhat is the critical patching target (24h / 72h / 7d / >7d)? partialIs data encrypted at rest on endpoints (laptops, desktops, portable devices)? partialIs software installation automatically controlled and unauthorized software blocked? attestedWhich Endpoint Detection & Response (EDR) product does the Applicant use? partialIs endpoint security centrally managed to monitor and force signature/agent updates? attestedIs application allow-listing enforced on critical servers to block unauthorized programs and scripts? partialAre unnecessary or unauthorized browser extensions blocked?

Email security and phishing

verifiedIs inbound email security (SEG) deployed with sandbox attachment detonation? verifiedDoes the Applicant employ a sandboxing solution for investigating suspicious emails/attachments? verifiedDoes the Applicant have a report-phishing email add-in enabled for all email users? verifiedDoes the Applicant employ SPF, DKIM, and DMARC? partialAre phishing simulations conducted for all employees, with click rate tracking? attestedHow does the Applicant handle repeat offenders/clickers in phishing simulations? attestedAre employees with financial/accounting responsibility given social engineering and phishing training? attestedWhich inbound email security product / Secure Email Gateway (SEG) does the Applicant use? verifiedAre external emails tagged as originating from an external source? verifiedIs legacy email authentication (IMAP, POP, basic authentication) disabled? verifiedIs email filtering in place for inbound mail?

Data handling and policy

partialDoes the Applicant collect, store, process, transmit PII / PHI / PCI? attestedDoes the Applicant collect biometric information (fingerprints, voice, face, iris, etc.)? attestedIs the Applicant PCI-DSS compliant, and at what merchant level? attestedHas the Applicant confirmed HIPAA compliance? verifiedIs sensitive data encrypted in transit? partialIs the Applicant compliant with cross-border data transfer laws? attestedDoes the Applicant have written information security policy reviewed and updated annually? partialAre users able to store data to the hard drive of portable computers or portable media devices? verifiedDoes the Applicant employ Data Loss Prevention (DLP)? attestedDoes the Applicant have written privacy policy reviewed by attorney and updated annually? partialDo users store business-critical information locally on their systems rather than on centralized storage?

Incident response and claims history

attestedDoes the Applicant have a written Incident Response plan? attestedHow frequently is the IR plan tested (quarterly/semi-annually/annually)? attestedDoes the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually? attestedIn last 3 years, any cyber event, claim, loss, security breach, or extortion demand? attestedAwareness of any fact / circumstance reasonably giving rise to a future claim? attestedHas the Applicant experienced any partial or total network interruption lasting more than 8 hours? partialAre copies of BCP/DR/IR plans stored so accessible if the Applicant's network is unavailable?

Third parties and vendors

attestedDoes the Applicant review and audit information security/privacy controls of IT, cloud, and non-IT service providers? verifiedIs service provider access to network/data restricted on least-privilege basis, reviewed periodically? attestedDo written agreements with third parties contain defense/indemnification + insurance requirements? attestedDoes the Applicant fully outsource payment card processing? attestedHas any service provider with access to Applicant's network sustained outage longer than 4 hours? partialDoes the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?

Network, logging and monitoring

partialDoes the Applicant employ external/perimeter and internal firewalls? verifiedIs RDP enabled, and if so, accessible internally only or externally? partialHas the Applicant applied network segmentation within its environment? partialAre development, testing, and production conducted in separate environments? partialDoes the Applicant employ intrusion detection/prevention? partialIs IP filtering used to prevent connections from known-malicious addresses? verifiedCan network ports only be opened with a legitimate business need? Port accessibility regularly verified? partialWhat is the firewall policy: deny all by default, permit by exception? partialHow frequently is firewall configuration reviewed and firmware updated? partialDoes the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS? partialHow long are audit logs maintained (30 / 90 / 1 year)? attestedDoes the Applicant conduct regular penetration testing? In-house or outsourced? partialDoes the Applicant conduct regular vulnerability scans? attestedAre independent security audits or assessments performed? attestedDoes the Applicant have a Security Operations Center (SOC) monitored 24/7? partialDoes local logging happen per-host? partialWhat percentage of hardware/software connected to network is inventoried? partialAre administrative/management login portals restricted from the public internet (closed or limited to specific IP addresses)? attestedHow is the Applicant's VPN infrastructure hosted (exclusively cloud-based, exclusively on-premises, or hybrid)? attestedWhich VPN provider/product does the Applicant use for remote connectivity? verifiedCan unauthorized devices be blocked from remotely accessing the network (e.g. MDM, allow-lists)? partialAre protective DNS or DNS filtering services in use? partialIs web gateway technology used to monitor and filter malicious or suspicious URLs? partialIs administrative access to servers restricted to a jump host or a limited number of endpoints? attestedIs workstation-to-workstation communication restricted (e.g. RDP between user workstations)? partialIs inbound and outbound traffic to critical servers restricted using an allow-list approach? attestedIs port-level network access control (e.g. 802.1X) used to admit only approved devices? attestedIs command-line activity in command shells (e.g. PowerShell, bash) logged and monitored? verifiedAre unsuccessful logins to administrative accounts logged and alerted on?

Governance and workforce

attestedWho is the most senior role with responsibility for information security (CISO/CSO/CIO)? attestedIs the Applicant's network security managed in-house or outsourced? attestedIs the InfoSec policy aligned with NIST CSF, ISO 27001, or other framework? attestedDoes the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors? attestedAre wire transfers over $25K dual-control authorized? Is callback verification required for new vendor / banking change? attestedAre job applicants screened (credit, criminal records, drug testing) as permitted by law? attestedDoes the Applicant participate in information sharing programs (ISAC, CISA, peer)? partialDoes the Applicant terminate computer access promptly when employee/contractor leaves? attestedDoes the Applicant have a privacy review process (attorney) for published content / media? attestedWhat is the Applicant's industry classification (NAICS / industry select)? partialWhat are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)? attestedDoes the Applicant attest that all statements in the application are true, complete, and accurate and form the basis of the policy (misrepresentation voids coverage)? attestedHow many IT personnel are on the Applicant's team? attestedHow many dedicated IT security personnel are on the Applicant's team? attestedDoes the Applicant use, disseminate or display material or content of others?

Business and financial profile

attestedWhat is the Applicant's annual gross revenue (current / previous fiscal year)? attestedWhat percentage of revenue is from ecommerce / online advertising? attestedIs the Applicant engaged in adult content, cryptocurrency, gambling, payment processing, or MSP/MSSP business? partialHow many records of PII / PHI / PCI / biometric does Applicant process? attestedDoes the Applicant provide data processing, storage, or hosting services to third parties? attestedAny significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)? partialWhat is total number of employees and contractors? How many working remotely? attestedWill the Applicant have an active Tech E&O / Professional Indemnity policy concurrent with this insurance? attestedDoes the organization send and/or receive wire transfers? attestedIs the Applicant engaged in any business other than its described operations?

Services and contracts

attestedWhat is the Applicant's primary technology business operations (Software / Hardware / Services)? attestedWhat type of clients does the Applicant primarily target (People / Organizations)? attestedWhich technology service lines are a significant part of the Applicant's revenue (consulting, MSP/MSSP, development, BPO, QA/testing, IT staffing/project management, telecom/ISP, e-recycling/data destruction, etc.)? attestedDo the Applicant's software products or services address any specific high-exposure activities (IT security, e-commerce, finance/banking, medical/healthcare, media broadcasting/streaming, ERP/CRM/SCM, custom programming)? attestedDoes the Applicant require additional Miscellaneous Professional Liability (MPL) coverage for non-technology professional services? attestedDoes the Applicant use written contracts or agreements with its customers for the provision of services or products? attestedDoes the Applicant have a formal process to ensure its products or services do not infringe the intellectual property rights of others? attestedDo the Applicant's client contracts contain limitation of liability clauses benefiting the Applicant? attestedDo the Applicant's client contracts exclude consequential damages in the Applicant's favor? attestedDo the Applicant's client contracts address guarantees or warranties? attestedDoes the Applicant assume liability for others under its contracts? attestedDoes the Applicant enter into contracts with fees contingent on client outcomes? attestedDo the Applicant's contracts include customer acceptance / final sign-off? attestedDo the Applicant's contracts include binding mandatory arbitration? attestedDo the Applicant's contracts define project phases / milestones?

Licensing and regulatory

attestedAre the Applicant's (and any Subsidiary's) facilities licensed in accordance with all relevant federal, state, local and foreign requirements?

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture