--- title: "How many dedicated IT security personnel are on the Applicant's team?" url: https://insuranceposture.com/questions/governance-and-workforce/dedicated-security-personnel-applicant-s-team category: "Governance and workforce" canonical_key: q_gov_014 evidence_state: attested updated: 2026-08-24 --- # How many dedicated IT security personnel are on the Applicant's team? URL: https://insuranceposture.com/questions/governance-and-workforce/dedicated-security-personnel-applicant-s-team Section: Governance and workforce Evidence state: Attested, not tenant-verifiable Zero is a common and acceptable answer. What matters is whether the security work has an owner, whether or not that person does only security. ## What the carrier is actually asking The carrier is asking how many people work on security as their primary role, distinct from IT staff who handle security among other duties. It is asking about dedicated capacity. ## Why it is underwritten Security competes badly with operational work when the same person does both, because outages are urgent and security is important. Dedicated capacity, internal or contracted, is what keeps the security programme moving. Carriers ask to understand whether the controls described are maintained or merely installed. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a headcount question, and outsourced capacity is the part most often misreported. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | HR records | Roles whose primary responsibility is security | Dedicated headcount, honestly counted. Attested | | Contracts | Managed detection or virtual security officer arrangements | Contracted capacity with hours and scope, stated separately | | Allocation | Where security is part of a broader role, the proportion of time | An honest estimate, which reads better than counting a shared role as dedicated | | Consistency | The monitoring and IT headcount answers | Consistency across the three, since they are read together | | Coverage | Who responds outside business hours | The arrangement that supports the response claims made elsewhere | **Contracted capacity is capacity** An organisation with no internal security staff and a managed detection provider plus a fractional security officer has meaningful dedicated capacity. Reporting zero without describing the arrangement understates a reasonable position. ## What a defensible yes requires - Dedicated internal headcount is stated accurately, including zero. - Contracted security capacity is described with scope and hours. - Where security is part of a broader role, that is stated rather than counted as dedicated. - The answer is consistent with the monitoring and IT headcount answers. - Out-of-hours responsibility is named. ## How this answer goes wrong An infrastructure engineer who spends part of their week on security is counted as a dedicated resource, which overstates capacity in a way the next incident will demonstrate. The opposite error is reporting zero while a capable provider does the work. ## If this answer turns out to be wrong The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is zero acceptable? Yes for many organisations, particularly with outsourced capability. Describe the arrangement rather than leaving the field at zero with no context. ### Do managed service staff count? Not as your headcount. State them separately as contracted capacity, which is accurate and gives the underwriter the full picture. ### Does a virtual security officer count? As contracted capacity, yes. It is a common arrangement and it answers the governance question about ownership at the same time. ### What ratio do carriers expect? No fixed ratio. They look for consistency between the headcount, the estate complexity, and the controls claimed. ## Related questions - [How many IT personnel are on the Applicant's team?](https://insuranceposture.com/questions/governance-and-workforce/personnel-applicant-s-team) - [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7) - [Who is the most senior role with responsibility for information security (CISO/CSO/CIO)?](https://insuranceposture.com/questions/governance-and-workforce/who-most-senior-role-responsibility-information-security) - [Is the Applicant's network security managed in-house or outsourced?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-network-security-managed-house-outsourced) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.