How many IT personnel are on the Applicant's team?
The number matters relative to two others: total headcount and the size of the estate it has to operate.
What the carrier is actually asking
The carrier wants the size of your IT function. It is looking at the ratio to total employees and to the complexity described elsewhere in the submission, as a proxy for whether the controls you claim can actually be operated.
Why it is underwritten
A thin IT function running a complex estate is a maturity risk regardless of the controls listed, because operating those controls takes time nobody has. Carriers use the ratio to sense-check the rest of the form.
Where the answer lives in Microsoft 365, Entra ID, and Azure
This is a headcount fact and it should be consistent with the other headcount answers on the form.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| HR records | Employees in IT roles | Actual headcount rather than an organisation chart with unfilled positions. Attested |
| Contracts | Outsourced or managed service resource | Stated separately, since a small internal team with a capable provider is a different picture from a small team alone |
| Consistency | The total employee figure given elsewhere | Ratio consistent with the rest of the submission |
| Roles | Whether security roles are counted here or separately | Consistency with the dedicated security headcount question that usually follows |
| Coverage | Out-of-hours arrangements | Whether the headcount can cover the response expectations claimed elsewhere |
A three-person IT team with a managed provider handling monitoring and patching should say so. Reporting three alone understates your capability; folding the provider into the number misstates a headcount fact. Give both.
What a defensible yes requires
- The figure reflects filled positions.
- Outsourced resource is stated separately with its scope.
- The ratio to total headcount is consistent with the other answers.
- Security roles are counted consistently with the following question.
- Out-of-hours coverage is described if the response claims elsewhere depend on it.
How this answer goes wrong
The number includes vacancies that have been open for months, or it excludes the managed provider that performs most of the operational work. Both distort the picture the underwriter is trying to form.
Frequently asked
Do contractors count?
State them separately. Long-term contractors performing IT work are part of your capacity and are not employees, so the honest answer distinguishes them.
What ratio is normal?
It varies enormously by sector and by how much is outsourced. Carriers use it as a sense check rather than a threshold.
Does a small team hurt us?
Not if it is paired with capable outsourcing and the controls are real. A small team claiming continuous monitoring with no provider is what raises questions.
How does this connect to the security headcount?
Directly. The next question usually asks for dedicated security personnel, and the two answers should be consistent with each other.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture