--- title: "What is total number of employees and contractors? How many working remotely?" url: https://insuranceposture.com/questions/business-profile/total-number-employees-contractors-working-remotely category: "Business and financial profile" canonical_key: q_fin_007 evidence_state: partial updated: 2026-08-24 --- # What is total number of employees and contractors? How many working remotely? URL: https://insuranceposture.com/questions/business-profile/total-number-employees-contractors-working-remotely Section: Business and financial profile Evidence state: Partly verifiable from your tenant Headcount sizes the attack surface. The remote proportion determines which of your controls actually apply to it. ## What the carrier is actually asking The carrier wants total employees and contractors, and how many work remotely. It uses headcount as a scale factor and the remote proportion as an indicator of where your controls need to operate. ## Why it is underwritten Each person is an account, a device, and a phishing target. A largely remote workforce means network-based controls cover little and identity and endpoint controls carry everything, which changes how the rest of the submission should be read. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Headcount comes from human resources, and the directory provides a useful cross-check that frequently disagrees. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | HR records | Employee and contractor headcount | Both populations counted, since contractors hold access and are often excluded from headcount. Attested | | Entra ID | Enabled accounts compared with the workforce figure | A reconciliation, since a directory substantially larger than the workforce indicates stale accounts | | Working pattern | Remote, hybrid, and office-based proportions | An honest split, since hybrid is the common reality and it means devices leave the network regularly | | Microsoft 365 | Device enrolment coverage against headcount | Whether managed devices roughly match the workforce, which is a reality check on endpoint coverage | | Consistency | Licence counts and training completion denominators | Consistency with the other answers that use headcount as a denominator | **Reconcile headcount against the directory** If the directory holds substantially more enabled accounts than you have people, the difference is stale accounts, service accounts, and guests. That comparison answers this question and improves the orphaned account answer at the same time. ## What a defensible yes requires - Employees and contractors are both counted and distinguished. - The remote and hybrid split is stated honestly. - The figure reconciles with enabled directory accounts. - Device management coverage is consistent with headcount. - Other headcount-derived answers on the form use the same denominator. ## How this answer goes wrong Contractors are excluded from headcount and included in the directory, so the account population exceeds the reported workforce by a third with no explanation. It also means the training and endpoint coverage percentages were calculated against the wrong denominator. ## If this answer turns out to be wrong Revenue and record counts are the rating base, so a misstatement here is material as arithmetic, and it is the category where insurers have historically reached for rescission. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how rescission voids a policy from inception](https://insuranceposture.com/glossary/rescission). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do contractors count? For risk purposes yes, because they hold access. Count them separately so the figure is accurate and the exposure is visible. ### Does remote work increase premium? Not usually on its own. It shifts which controls matter, and carriers look for device management and identity controls to carry the weight. ### What counts as remote? Anyone working outside a corporate network regularly, which includes hybrid workers. Report the practical reality rather than the formal policy. ### Why does the directory disagree? Service accounts, guests, shared mailboxes, and stale accounts. Explaining the difference is a useful exercise regardless of the application. ## Related questions - [Are all accounts associated with legitimate processes or current users (no orphaned/stale)?](https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users) - [Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?](https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors) - [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) - [What is the Applicant's annual gross revenue (current / previous fiscal year)?](https://insuranceposture.com/questions/business-profile/applicant-s-annual-gross-revenue) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.