---
title: Access control and privilege questions on cyber insurance applications
url: "https://insuranceposture.com/questions/access-control"
section: Access control and privilege
questions: 12
updated: 2026-08-24
---

# Access control and privilege: what cyber insurance applications ask

Privileged accounts, least privilege, admin activity auditing, and password practice. Carriers read this block as the blast radius of a single compromised credential.

## 12 questions in this section

- [Does the Applicant utilize a Privileged Access Management (PAM) tool?](https://insuranceposture.com/questions/access-control/applicant-utilize-privileged-access-management-tool) (partly verifiable from your tenant)
- [How many domain and service accounts are in the Domain Admin Group?](https://insuranceposture.com/questions/access-control/domain-service-accounts-domain-admin-group) (partly verifiable from your tenant)
- [Are all accounts associated with legitimate processes or current users (no orphaned/stale)?](https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users) (verifiable from your tenant)
- [Is access restricted on a least-privilege basis to network, Personal Information, and Critical Information?](https://insuranceposture.com/questions/access-control/access-restricted-least-privilege-basis-network-personal-information-critical) (partly verifiable from your tenant)
- [Are administrator privileged access activities audited?](https://insuranceposture.com/questions/access-control/administrator-privileged-access-activities-audited) (verifiable from your tenant)
- [Are changes to administrator accounts reported automatically?](https://insuranceposture.com/questions/access-control/changes-administrator-accounts-reported-automatically) (verifiable from your tenant)
- [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) (verifiable from your tenant)
- [Does the use and distribution of administrator and privileged access require senior management approval?](https://insuranceposture.com/questions/access-control/distribution-administrator-privileged-access-require-senior-management-approval) (partly verifiable from your tenant)
- [Are wireless connections from untrusted devices allowed, and if so, are they on a separate network?](https://insuranceposture.com/questions/access-control/wireless-connections-from-untrusted-devices-allowed-they-separate-network) (attested, not tenant-verifiable)
- [Does the Applicant use a password manager to maintain master/privileged passwords used to access client systems and IT infrastructure?](https://insuranceposture.com/questions/access-control/applicant-password-manager-maintain-master-privileged-passwords-access-client) (attested, not tenant-verifiable)
- [Are master/privileged passwords used to access client systems and IT infrastructure unique and not reused?](https://insuranceposture.com/questions/access-control/master-privileged-passwords-access-client-systems-infrastructure-unique-not) (attested, not tenant-verifiable)
- [Does the Applicant enforce a strong password policy (complexity, periodic rotation, and account lockout after repeated failed attempts)?](https://insuranceposture.com/questions/access-control/applicant-enforce-strong-password-policy) (partly verifiable from your tenant)

Full index: https://insuranceposture.com/questions

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.