How many dedicated IT security personnel are on the Applicant's team?
Zero is a common and acceptable answer. What matters is whether the security work has an owner, whether or not that person does only security.
What the carrier is actually asking
The carrier is asking how many people work on security as their primary role, distinct from IT staff who handle security among other duties. It is asking about dedicated capacity.
Why it is underwritten
Security competes badly with operational work when the same person does both, because outages are urgent and security is important. Dedicated capacity, internal or contracted, is what keeps the security programme moving. Carriers ask to understand whether the controls described are maintained or merely installed.
Where the answer lives in Microsoft 365, Entra ID, and Azure
This is a headcount question, and outsourced capacity is the part most often misreported.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| HR records | Roles whose primary responsibility is security | Dedicated headcount, honestly counted. Attested |
| Contracts | Managed detection or virtual security officer arrangements | Contracted capacity with hours and scope, stated separately |
| Allocation | Where security is part of a broader role, the proportion of time | An honest estimate, which reads better than counting a shared role as dedicated |
| Consistency | The monitoring and IT headcount answers | Consistency across the three, since they are read together |
| Coverage | Who responds outside business hours | The arrangement that supports the response claims made elsewhere |
An organisation with no internal security staff and a managed detection provider plus a fractional security officer has meaningful dedicated capacity. Reporting zero without describing the arrangement understates a reasonable position.
What a defensible yes requires
- Dedicated internal headcount is stated accurately, including zero.
- Contracted security capacity is described with scope and hours.
- Where security is part of a broader role, that is stated rather than counted as dedicated.
- The answer is consistent with the monitoring and IT headcount answers.
- Out-of-hours responsibility is named.
How this answer goes wrong
An infrastructure engineer who spends part of their week on security is counted as a dedicated resource, which overstates capacity in a way the next incident will demonstrate. The opposite error is reporting zero while a capable provider does the work.
Frequently asked
Is zero acceptable?
Yes for many organisations, particularly with outsourced capability. Describe the arrangement rather than leaving the field at zero with no context.
Do managed service staff count?
Not as your headcount. State them separately as contracted capacity, which is accurate and gives the underwriter the full picture.
Does a virtual security officer count?
As contracted capacity, yes. It is a common arrangement and it answers the governance question about ownership at the same time.
What ratio do carriers expect?
No fixed ratio. They look for consistency between the headcount, the estate complexity, and the controls claimed.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture