Multi-factor authentication: what cyber insurance applications ask

Where MFA is enforced, on whom, and with which factor. The single most consequential block on a cyber application, and the one carriers most often verify after a claim.

6 questions in this section

verifiedIs multi-factor authentication enforced on all email access? partialIs MFA enforced on all remote access (VPN, RDP, remote network admin)? verifiedIs MFA enforced on all privileged / administrative user accounts? partialIs MFA enforced on cloud provider (AWS / Azure / GCP) management consoles? verifiedWhat secondary factor method is used for MFA (SMS / Authenticator / Hardware key / Biometric)? partialIs multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?

Back to the full question index

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture