---
title: Cyber insurance application questions, answered one at a time
url: "https://insuranceposture.com/questions"
questions: 147
sections: 13
updated: 2026-08-24
---

# Cyber insurance application questions, one page at a time

Carriers ask the same things in different words. Each page below takes one question as it is worded on an application, explains what the underwriter is measuring, and shows where the answer lives in Microsoft 365, Entra ID, and Azure. The questions are written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.

## How to read the evidence state

An answer is **verifiable** when the live configuration of your tenant settles it, **partly verifiable** when the tenant settles part of it and a process or a system we do not read settles the rest, and **attested** when no technical reading can settle it and an authorised signer has to stand behind it.

## Sections

- [Multi-factor authentication](https://insuranceposture.com/questions/multi-factor-authentication): 6 questions. Where MFA is enforced, on whom, and with which factor. The single most consequential block on a cyber application, and the one carriers most often verify after a claim.
- [Access control and privilege](https://insuranceposture.com/questions/access-control): 12 questions. Privileged accounts, least privilege, admin activity auditing, and password practice. Carriers read this block as the blast radius of a single compromised credential.
- [Backup and recovery](https://insuranceposture.com/questions/backup-and-recovery): 12 questions. Immutability, separate credentials, encryption, restore testing, and recovery time. This block drives ransomware pricing more than any other technical section.
- [Endpoint protection and patching](https://insuranceposture.com/questions/endpoint-and-patching): 12 questions. EDR coverage, next-generation antivirus, end-of-life software, patch cadence, disk encryption, and application control on endpoints.
- [Email security and phishing](https://insuranceposture.com/questions/email-security): 11 questions. Mail filtering, attachment detonation, SPF, DKIM, DMARC, external tagging, legacy authentication, and phishing simulation practice.
- [Data handling and policy](https://insuranceposture.com/questions/data-handling): 11 questions. What regulated data you hold, how it is encrypted and prevented from leaving, and which written policies stand behind those answers.
- [Incident response and claims history](https://insuranceposture.com/questions/incident-response): 7 questions. Written plans, testing cadence, prior incidents, and knowledge of circumstances. The claims-history questions here carry the harshest consequence for an inaccurate answer.
- [Third parties and vendors](https://insuranceposture.com/questions/third-parties): 6 questions. Vendor review, service-provider access, contractual indemnity and insurance requirements, and where your sensitive records actually sit.
- [Network, logging and monitoring](https://insuranceposture.com/questions/network-and-logging): 29 questions. Firewalls, segmentation, remote access exposure, DNS and web filtering, log centralization, retention, and testing regimes.
- [Governance and workforce](https://insuranceposture.com/questions/governance-and-workforce): 15 questions. Who owns security, which framework the policy follows, training, joiner-mover-leaver practice, and the attestation clause itself.
- [Business and financial profile](https://insuranceposture.com/questions/business-profile): 10 questions. Revenue, record counts, remote headcount, business activities, and other underwriting inputs that set your limit and rate before a single control is read.
- [Services and contracts](https://insuranceposture.com/questions/services-and-contracts): 15 questions. Technology E&O questions: what you sell, to whom, and what your client contracts say about liability, warranties, acceptance, and arbitration.
- [Licensing and regulatory](https://insuranceposture.com/questions/licensing): 1 question. Facility and operating licences required by federal, state, local, and foreign regulators.

## Multi-factor authentication

- [Is multi-factor authentication enforced on all email access?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-email-access) (verifiable from your tenant)
- [Is MFA enforced on all remote access (VPN, RDP, remote network admin)?](https://insuranceposture.com/questions/multi-factor-authentication/mfa-enforced-remote-access) (partly verifiable from your tenant)
- [Is MFA enforced on all privileged / administrative user accounts?](https://insuranceposture.com/questions/multi-factor-authentication/mfa-enforced-privileged-administrative-user-accounts) (verifiable from your tenant)
- [Is MFA enforced on cloud provider (AWS / Azure / GCP) management consoles?](https://insuranceposture.com/questions/multi-factor-authentication/mfa-enforced-cloud-provider-management-consoles) (partly verifiable from your tenant)
- [What secondary factor method is used for MFA (SMS / Authenticator / Hardware key / Biometric)?](https://insuranceposture.com/questions/multi-factor-authentication/secondary-factor-method-mfa) (verifiable from your tenant)
- [Is multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-access-clients-systems-remote-monitoring) (partly verifiable from your tenant)

## Access control and privilege

- [Does the Applicant utilize a Privileged Access Management (PAM) tool?](https://insuranceposture.com/questions/access-control/applicant-utilize-privileged-access-management-tool) (partly verifiable from your tenant)
- [How many domain and service accounts are in the Domain Admin Group?](https://insuranceposture.com/questions/access-control/domain-service-accounts-domain-admin-group) (partly verifiable from your tenant)
- [Are all accounts associated with legitimate processes or current users (no orphaned/stale)?](https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users) (verifiable from your tenant)
- [Is access restricted on a least-privilege basis to network, Personal Information, and Critical Information?](https://insuranceposture.com/questions/access-control/access-restricted-least-privilege-basis-network-personal-information-critical) (partly verifiable from your tenant)
- [Are administrator privileged access activities audited?](https://insuranceposture.com/questions/access-control/administrator-privileged-access-activities-audited) (verifiable from your tenant)
- [Are changes to administrator accounts reported automatically?](https://insuranceposture.com/questions/access-control/changes-administrator-accounts-reported-automatically) (verifiable from your tenant)
- [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) (verifiable from your tenant)
- [Does the use and distribution of administrator and privileged access require senior management approval?](https://insuranceposture.com/questions/access-control/distribution-administrator-privileged-access-require-senior-management-approval) (partly verifiable from your tenant)
- [Are wireless connections from untrusted devices allowed, and if so, are they on a separate network?](https://insuranceposture.com/questions/access-control/wireless-connections-from-untrusted-devices-allowed-they-separate-network) (attested, not tenant-verifiable)
- [Does the Applicant use a password manager to maintain master/privileged passwords used to access client systems and IT infrastructure?](https://insuranceposture.com/questions/access-control/applicant-password-manager-maintain-master-privileged-passwords-access-client) (attested, not tenant-verifiable)
- [Are master/privileged passwords used to access client systems and IT infrastructure unique and not reused?](https://insuranceposture.com/questions/access-control/master-privileged-passwords-access-client-systems-infrastructure-unique-not) (attested, not tenant-verifiable)
- [Does the Applicant enforce a strong password policy (complexity, periodic rotation, and account lockout after repeated failed attempts)?](https://insuranceposture.com/questions/access-control/applicant-enforce-strong-password-policy) (partly verifiable from your tenant)

## Backup and recovery

- [Are there procedures and tools to back up sensitive data and critical systems?](https://insuranceposture.com/questions/backup-and-recovery/procedures-tools-back-up-sensitive-data-critical-systems) (attested, not tenant-verifiable)
- [Are backups kept offline (disconnected) or immutable / air-gapped?](https://insuranceposture.com/questions/backup-and-recovery/backups-kept-offline-immutable-air-gapped) (partly verifiable from your tenant)
- [Are backups encrypted?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted) (partly verifiable from your tenant)
- [Are backups protected by MFA?](https://insuranceposture.com/questions/backup-and-recovery/backups-protected-by-mfa) (partly verifiable from your tenant)
- [Are backups secured with different access credentials from administrator credentials?](https://insuranceposture.com/questions/backup-and-recovery/backups-secured-different-access-credentials-from-administrator-credentials) (partly verifiable from your tenant)
- [Have you tested the successful restoration and recovery of key server configurations and data from backups in the last 6 months?](https://insuranceposture.com/questions/backup-and-recovery/you-tested-successful-restoration-recovery-key-server-configurations-data) (attested, not tenant-verifiable)
- [Are backups tested for malware-free integrity prior to restoration?](https://insuranceposture.com/questions/backup-and-recovery/backups-tested-malware-free-integrity-prior-restoration) (attested, not tenant-verifiable)
- [Estimated time to restore essential functions in widespread ransomware attack?](https://insuranceposture.com/questions/backup-and-recovery/estimated-time-restore-essential-functions-widespread-ransomware-attack) (attested, not tenant-verifiable)
- [How frequently is critical data backed up?](https://insuranceposture.com/questions/backup-and-recovery/frequently-critical-data-backed-up) (partly verifiable from your tenant)
- [Where are backups stored (on-prem / offsite / offline / MSSP / cloud)?](https://insuranceposture.com/questions/backup-and-recovery/where-backups-stored) (partly verifiable from your tenant)
- [If backups are encrypted, are encryption keys stored offline?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted-encryption-keys-stored-offline) (partly verifiable from your tenant)
- [Can workstations be reimaged in bulk from a controlled operating system image?](https://insuranceposture.com/questions/backup-and-recovery/can-workstations-reimaged-bulk-from-controlled-operating-system-image) (partly verifiable from your tenant)

## Endpoint protection and patching

- [Is endpoint detection & response (EDR) deployed with central monitoring?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-deployed-central-monitoring) (partly verifiable from your tenant)
- [Is next-generation antivirus (NGAV) deployed on all endpoints?](https://insuranceposture.com/questions/endpoint-and-patching/next-generation-antivirus-deployed-endpoints) (partly verifiable from your tenant)
- [What percentage of endpoints have EDR deployed?](https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed) (partly verifiable from your tenant)
- [Does the Applicant use any operating system, hardware or software that is no longer supported / End-of-Life?](https://insuranceposture.com/questions/endpoint-and-patching/applicant-operating-system-hardware-software-no-longer-supported-end) (partly verifiable from your tenant)
- [How frequently is software updated, vulnerabilities patched, unnecessary services disabled?](https://insuranceposture.com/questions/endpoint-and-patching/frequently-software-updated-vulnerabilities-patched-unnecessary-services-disabled) (partly verifiable from your tenant)
- [What is the critical patching target (24h / 72h / 7d / >7d)?](https://insuranceposture.com/questions/endpoint-and-patching/critical-patching-target) (partly verifiable from your tenant)
- [Is data encrypted at rest on endpoints (laptops, desktops, portable devices)?](https://insuranceposture.com/questions/endpoint-and-patching/data-encrypted-at-rest-endpoints) (partly verifiable from your tenant)
- [Is software installation automatically controlled and unauthorized software blocked?](https://insuranceposture.com/questions/endpoint-and-patching/software-installation-automatically-controlled-unauthorized-software-blocked) (partly verifiable from your tenant)
- [Which Endpoint Detection & Response (EDR) product does the Applicant use?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-product-applicant) (attested, not tenant-verifiable)
- [Is endpoint security centrally managed to monitor and force signature/agent updates?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-security-centrally-managed-monitor-force-signature-agent-updates) (partly verifiable from your tenant)
- [Is application allow-listing enforced on critical servers to block unauthorized programs and scripts?](https://insuranceposture.com/questions/endpoint-and-patching/application-allow-listing-enforced-critical-servers-block-unauthorized-programs) (attested, not tenant-verifiable)
- [Are unnecessary or unauthorized browser extensions blocked?](https://insuranceposture.com/questions/endpoint-and-patching/unnecessary-unauthorized-browser-extensions-blocked) (partly verifiable from your tenant)

## Email security and phishing

- [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation) (verifiable from your tenant)
- [Does the Applicant employ a sandboxing solution for investigating suspicious emails/attachments?](https://insuranceposture.com/questions/email-security/applicant-employ-sandboxing-solution-investigating-suspicious-emails-attachments) (verifiable from your tenant)
- [Does the Applicant have a report-phishing email add-in enabled for all email users?](https://insuranceposture.com/questions/email-security/applicant-report-phishing-email-add-enabled-email-users) (verifiable from your tenant)
- [Does the Applicant employ SPF, DKIM, and DMARC?](https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc) (verifiable from your tenant)
- [Are phishing simulations conducted for all employees, with click rate tracking?](https://insuranceposture.com/questions/email-security/phishing-simulations-conducted-employees-click-rate-tracking) (partly verifiable from your tenant)
- [How does the Applicant handle repeat offenders/clickers in phishing simulations?](https://insuranceposture.com/questions/email-security/applicant-handle-repeat-offenders-clickers-phishing-simulations) (attested, not tenant-verifiable)
- [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training) (attested, not tenant-verifiable)
- [Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?](https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant) (attested, not tenant-verifiable)
- [Are external emails tagged as originating from an external source?](https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source) (verifiable from your tenant)
- [Is legacy email authentication (IMAP, POP, basic authentication) disabled?](https://insuranceposture.com/questions/email-security/legacy-email-authentication-disabled) (verifiable from your tenant)
- [Is email filtering in place for inbound mail?](https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail) (verifiable from your tenant)

## Data handling and policy

- [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci) (partly verifiable from your tenant)
- [Does the Applicant collect biometric information (fingerprints, voice, face, iris, etc.)?](https://insuranceposture.com/questions/data-handling/applicant-collect-biometric-information) (attested, not tenant-verifiable)
- [Is the Applicant PCI-DSS compliant, and at what merchant level?](https://insuranceposture.com/questions/data-handling/applicant-pci-dss-compliant-at-merchant-level) (attested, not tenant-verifiable)
- [Has the Applicant confirmed HIPAA compliance?](https://insuranceposture.com/questions/data-handling/applicant-confirmed-hipaa-compliance) (attested, not tenant-verifiable)
- [Is sensitive data encrypted in transit?](https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit) (verifiable from your tenant)
- [Is the Applicant compliant with cross-border data transfer laws?](https://insuranceposture.com/questions/data-handling/applicant-compliant-cross-border-data-transfer-laws) (partly verifiable from your tenant)
- [Does the Applicant have written information security policy reviewed and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-information-security-policy-reviewed-updated-annually) (attested, not tenant-verifiable)
- [Are users able to store data to the hard drive of portable computers or portable media devices?](https://insuranceposture.com/questions/data-handling/users-able-store-data-hard-drive-portable-computers-portable) (partly verifiable from your tenant)
- [Does the Applicant employ Data Loss Prevention (DLP)?](https://insuranceposture.com/questions/data-handling/applicant-employ-data-loss-prevention) (verifiable from your tenant)
- [Does the Applicant have written privacy policy reviewed by attorney and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-privacy-policy-reviewed-by-attorney-updated-annually) (attested, not tenant-verifiable)
- [Do users store business-critical information locally on their systems rather than on centralized storage?](https://insuranceposture.com/questions/data-handling/users-store-business-critical-information-locally-systems-rather-than) (partly verifiable from your tenant)

## Incident response and claims history

- [Does the Applicant have a written Incident Response plan?](https://insuranceposture.com/questions/incident-response/applicant-written-incident-response-plan) (attested, not tenant-verifiable)
- [How frequently is the IR plan tested (quarterly/semi-annually/annually)?](https://insuranceposture.com/questions/incident-response/frequently-ir-plan-tested) (attested, not tenant-verifiable)
- [Does the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually?](https://insuranceposture.com/questions/incident-response/applicant-written-business-continuity-plan-disaster-recovery-plan-tested) (attested, not tenant-verifiable)
- [In last 3 years, any cyber event, claim, loss, security breach, or extortion demand?](https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach) (attested, not tenant-verifiable)
- [Awareness of any fact / circumstance reasonably giving rise to a future claim?](https://insuranceposture.com/questions/incident-response/awareness-fact-circumstance-reasonably-giving-rise-future-claim) (attested, not tenant-verifiable)
- [Has the Applicant experienced any partial or total network interruption lasting more than 8 hours?](https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than) (attested, not tenant-verifiable)
- [Are copies of BCP/DR/IR plans stored so accessible if the Applicant's network is unavailable?](https://insuranceposture.com/questions/incident-response/copies-bcp-dr-ir-plans-stored-accessible-applicant-s) (partly verifiable from your tenant)

## Third parties and vendors

- [Does the Applicant review and audit information security/privacy controls of IT, cloud, and non-IT service providers?](https://insuranceposture.com/questions/third-parties/applicant-review-audit-information-security-privacy-controls-cloud-non) (attested, not tenant-verifiable)
- [Is service provider access to network/data restricted on least-privilege basis, reviewed periodically?](https://insuranceposture.com/questions/third-parties/service-provider-access-network-data-restricted-least-privilege-basis) (verifiable from your tenant)
- [Do written agreements with third parties contain defense/indemnification + insurance requirements?](https://insuranceposture.com/questions/third-parties/written-agreements-third-parties-contain-defense-indemnification-insurance-requirements) (attested, not tenant-verifiable)
- [Does the Applicant fully outsource payment card processing?](https://insuranceposture.com/questions/third-parties/applicant-fully-outsource-payment-card-processing) (attested, not tenant-verifiable)
- [Has any service provider with access to Applicant's network sustained outage longer than 4 hours?](https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer) (attested, not tenant-verifiable)
- [Does the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?](https://insuranceposture.com/questions/third-parties/applicant-cloud-provider-provider-stores-largest-quantity-sensitive-records) (partly verifiable from your tenant)

## Network, logging and monitoring

- [Does the Applicant employ external/perimeter and internal firewalls?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls) (partly verifiable from your tenant)
- [Is RDP enabled, and if so, accessible internally only or externally?](https://insuranceposture.com/questions/network-and-logging/rdp-enabled-accessible-internally-only-externally) (verifiable from your tenant)
- [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment) (partly verifiable from your tenant)
- [Are development, testing, and production conducted in separate environments?](https://insuranceposture.com/questions/network-and-logging/development-testing-production-conducted-separate-environments) (partly verifiable from your tenant)
- [Does the Applicant employ intrusion detection/prevention?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-intrusion-detection-prevention) (partly verifiable from your tenant)
- [Is IP filtering used to prevent connections from known-malicious addresses?](https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses) (partly verifiable from your tenant)
- [Can network ports only be opened with a legitimate business need? Port accessibility regularly verified?](https://insuranceposture.com/questions/network-and-logging/can-network-ports-only-opened-legitimate-business-need-port) (verifiable from your tenant)
- [What is the firewall policy: deny all by default, permit by exception?](https://insuranceposture.com/questions/network-and-logging/firewall-policy-deny-by-default-permit-by-exception) (partly verifiable from your tenant)
- [How frequently is firewall configuration reviewed and firmware updated?](https://insuranceposture.com/questions/network-and-logging/frequently-firewall-configuration-reviewed-firmware-updated) (partly verifiable from your tenant)
- [Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls) (partly verifiable from your tenant)
- [How long are audit logs maintained (30 / 90 / 1 year)?](https://insuranceposture.com/questions/network-and-logging/long-audit-logs-maintained) (partly verifiable from your tenant)
- [Does the Applicant conduct regular penetration testing? In-house or outsourced?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-penetration-testing-house-outsourced) (attested, not tenant-verifiable)
- [Does the Applicant conduct regular vulnerability scans?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-vulnerability-scans) (partly verifiable from your tenant)
- [Are independent security audits or assessments performed?](https://insuranceposture.com/questions/network-and-logging/independent-security-audits-assessments-performed) (attested, not tenant-verifiable)
- [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7) (attested, not tenant-verifiable)
- [Does local logging happen per-host?](https://insuranceposture.com/questions/network-and-logging/local-logging-happen-per-host) (partly verifiable from your tenant)
- [What percentage of hardware/software connected to network is inventoried?](https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried) (partly verifiable from your tenant)
- [Are administrative/management login portals restricted from the public internet (closed or limited to specific IP addresses)?](https://insuranceposture.com/questions/network-and-logging/administrative-management-login-portals-restricted-from-public-internet) (partly verifiable from your tenant)
- [How is the Applicant's VPN infrastructure hosted (exclusively cloud-based, exclusively on-premises, or hybrid)?](https://insuranceposture.com/questions/network-and-logging/applicant-s-vpn-infrastructure-hosted) (attested, not tenant-verifiable)
- [Which VPN provider/product does the Applicant use for remote connectivity?](https://insuranceposture.com/questions/network-and-logging/vpn-provider-product-applicant-remote-connectivity) (attested, not tenant-verifiable)
- [Can unauthorized devices be blocked from remotely accessing the network (e.g. MDM, allow-lists)?](https://insuranceposture.com/questions/network-and-logging/can-unauthorized-devices-blocked-from-remotely-accessing-network) (verifiable from your tenant)
- [Are protective DNS or DNS filtering services in use?](https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services) (partly verifiable from your tenant)
- [Is web gateway technology used to monitor and filter malicious or suspicious URLs?](https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls) (partly verifiable from your tenant)
- [Is administrative access to servers restricted to a jump host or a limited number of endpoints?](https://insuranceposture.com/questions/network-and-logging/administrative-access-servers-restricted-jump-host-limited-number-endpoints) (partly verifiable from your tenant)
- [Is workstation-to-workstation communication restricted (e.g. RDP between user workstations)?](https://insuranceposture.com/questions/network-and-logging/workstation-workstation-communication-restricted) (attested, not tenant-verifiable)
- [Is inbound and outbound traffic to critical servers restricted using an allow-list approach?](https://insuranceposture.com/questions/network-and-logging/inbound-outbound-traffic-critical-servers-restricted-using-allow-list) (partly verifiable from your tenant)
- [Is port-level network access control (e.g. 802.1X) used to admit only approved devices?](https://insuranceposture.com/questions/network-and-logging/port-level-network-access-control-admit-only-approved-devices) (attested, not tenant-verifiable)
- [Is command-line activity in command shells (e.g. PowerShell, bash) logged and monitored?](https://insuranceposture.com/questions/network-and-logging/command-line-activity-command-shells-logged-monitored) (attested, not tenant-verifiable)
- [Are unsuccessful logins to administrative accounts logged and alerted on?](https://insuranceposture.com/questions/network-and-logging/unsuccessful-logins-administrative-accounts-logged-alerted) (verifiable from your tenant)

## Governance and workforce

- [Who is the most senior role with responsibility for information security (CISO/CSO/CIO)?](https://insuranceposture.com/questions/governance-and-workforce/who-most-senior-role-responsibility-information-security) (attested, not tenant-verifiable)
- [Is the Applicant's network security managed in-house or outsourced?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-network-security-managed-house-outsourced) (attested, not tenant-verifiable)
- [Is the InfoSec policy aligned with NIST CSF, ISO 27001, or other framework?](https://insuranceposture.com/questions/governance-and-workforce/infosec-policy-aligned-nist-csf-iso-27001-other-framework) (attested, not tenant-verifiable)
- [Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?](https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors) (attested, not tenant-verifiable)
- [Are wire transfers over $25K dual-control authorized? Is callback verification required for new vendor / banking change?](https://insuranceposture.com/questions/governance-and-workforce/wire-transfers-over-25k-dual-control-authorized-callback-verification) (attested, not tenant-verifiable)
- [Are job applicants screened (credit, criminal records, drug testing) as permitted by law?](https://insuranceposture.com/questions/governance-and-workforce/job-applicants-screened-as-permitted-by-law) (attested, not tenant-verifiable)
- [Does the Applicant participate in information sharing programs (ISAC, CISA, peer)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-participate-information-sharing-programs) (attested, not tenant-verifiable)
- [Does the Applicant terminate computer access promptly when employee/contractor leaves?](https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves) (partly verifiable from your tenant)
- [Does the Applicant have a privacy review process (attorney) for published content / media?](https://insuranceposture.com/questions/governance-and-workforce/applicant-privacy-review-process-published-content-media) (attested, not tenant-verifiable)
- [What is the Applicant's industry classification (NAICS / industry select)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-industry-classification) (attested, not tenant-verifiable)
- [What are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-websites-domains) (partly verifiable from your tenant)
- [Does the Applicant attest that all statements in the application are true, complete, and accurate and form the basis of the policy (misrepresentation voids coverage)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-attest-statements-application-true-complete-accurate-form-basis) (attested, not tenant-verifiable)
- [How many IT personnel are on the Applicant's team?](https://insuranceposture.com/questions/governance-and-workforce/personnel-applicant-s-team) (attested, not tenant-verifiable)
- [How many dedicated IT security personnel are on the Applicant's team?](https://insuranceposture.com/questions/governance-and-workforce/dedicated-security-personnel-applicant-s-team) (attested, not tenant-verifiable)
- [Does the Applicant use, disseminate or display material or content of others?](https://insuranceposture.com/questions/governance-and-workforce/applicant-disseminate-display-material-content-others) (attested, not tenant-verifiable)

## Business and financial profile

- [What is the Applicant's annual gross revenue (current / previous fiscal year)?](https://insuranceposture.com/questions/business-profile/applicant-s-annual-gross-revenue) (attested, not tenant-verifiable)
- [What percentage of revenue is from ecommerce / online advertising?](https://insuranceposture.com/questions/business-profile/percentage-revenue-from-ecommerce-online-advertising) (attested, not tenant-verifiable)
- [Is the Applicant engaged in adult content, cryptocurrency, gambling, payment processing, or MSP/MSSP business?](https://insuranceposture.com/questions/business-profile/applicant-engaged-adult-content-cryptocurrency-gambling-payment-processing-msp) (attested, not tenant-verifiable)
- [How many records of PII / PHI / PCI / biometric does Applicant process?](https://insuranceposture.com/questions/business-profile/records-pii-phi-pci-biometric-applicant-process) (partly verifiable from your tenant)
- [Does the Applicant provide data processing, storage, or hosting services to third parties?](https://insuranceposture.com/questions/business-profile/applicant-provide-data-processing-storage-hosting-services-third-parties) (attested, not tenant-verifiable)
- [Any significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)?](https://insuranceposture.com/questions/business-profile/significant-changes-nature-size-business-anticipated-next-12-months) (attested, not tenant-verifiable)
- [What is total number of employees and contractors? How many working remotely?](https://insuranceposture.com/questions/business-profile/total-number-employees-contractors-working-remotely) (partly verifiable from your tenant)
- [Will the Applicant have an active Tech E&O / Professional Indemnity policy concurrent with this insurance?](https://insuranceposture.com/questions/business-profile/will-applicant-active-tech-e-o-professional-indemnity-policy) (attested, not tenant-verifiable)
- [Does the organization send and/or receive wire transfers?](https://insuranceposture.com/questions/business-profile/organization-send-receive-wire-transfers) (attested, not tenant-verifiable)
- [Is the Applicant engaged in any business other than its described operations?](https://insuranceposture.com/questions/business-profile/applicant-engaged-business-other-than-described-operations) (attested, not tenant-verifiable)

## Services and contracts

- [What is the Applicant's primary technology business operations (Software / Hardware / Services)?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-primary-technology-business-operations) (attested, not tenant-verifiable)
- [What type of clients does the Applicant primarily target (People / Organizations)?](https://insuranceposture.com/questions/services-and-contracts/type-clients-applicant-primarily-target) (attested, not tenant-verifiable)
- [Which technology service lines are a significant part of the Applicant's revenue (consulting, MSP/MSSP, development, BPO, QA/testing, IT staffing/project management, telecom/ISP, e-recycling/data destruction, etc.)?](https://insuranceposture.com/questions/services-and-contracts/technology-service-lines-significant-part-applicant-s-revenue) (attested, not tenant-verifiable)
- [Do the Applicant's software products or services address any specific high-exposure activities (IT security, e-commerce, finance/banking, medical/healthcare, media broadcasting/streaming, ERP/CRM/SCM, custom programming)?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-software-products-services-address-specific-high-exposure) (attested, not tenant-verifiable)
- [Does the Applicant require additional Miscellaneous Professional Liability (MPL) coverage for non-technology professional services?](https://insuranceposture.com/questions/services-and-contracts/applicant-require-additional-miscellaneous-professional-liability-coverage-non-technology) (attested, not tenant-verifiable)
- [Does the Applicant use written contracts or agreements with its customers for the provision of services or products?](https://insuranceposture.com/questions/services-and-contracts/applicant-written-contracts-agreements-customers-provision-services-products) (attested, not tenant-verifiable)
- [Does the Applicant have a formal process to ensure its products or services do not infringe the intellectual property rights of others?](https://insuranceposture.com/questions/services-and-contracts/applicant-formal-process-ensure-products-services-not-infringe-intellectual) (attested, not tenant-verifiable)
- [Do the Applicant's client contracts contain limitation of liability clauses benefiting the Applicant?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-contain-limitation-liability-clauses-benefiting) (attested, not tenant-verifiable)
- [Do the Applicant's client contracts exclude consequential damages in the Applicant's favor?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-exclude-consequential-damages-applicant-s) (attested, not tenant-verifiable)
- [Do the Applicant's client contracts address guarantees or warranties?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-address-guarantees-warranties) (attested, not tenant-verifiable)
- [Does the Applicant assume liability for others under its contracts?](https://insuranceposture.com/questions/services-and-contracts/applicant-assume-liability-others-under-contracts) (attested, not tenant-verifiable)
- [Does the Applicant enter into contracts with fees contingent on client outcomes?](https://insuranceposture.com/questions/services-and-contracts/applicant-enter-into-contracts-fees-contingent-client-outcomes) (attested, not tenant-verifiable)
- [Do the Applicant's contracts include customer acceptance / final sign-off?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-contracts-include-customer-acceptance-final-sign-off) (attested, not tenant-verifiable)
- [Do the Applicant's contracts include binding mandatory arbitration?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-contracts-include-binding-mandatory-arbitration) (attested, not tenant-verifiable)
- [Do the Applicant's contracts define project phases / milestones?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-contracts-define-project-phases-milestones) (attested, not tenant-verifiable)

## Licensing and regulatory

- [Are the Applicant's (and any Subsidiary's) facilities licensed in accordance with all relevant federal, state, local and foreign requirements?](https://insuranceposture.com/questions/licensing/applicant-s-facilities-licensed-accordance-relevant-federal-state-local) (attested, not tenant-verifiable)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.