--- title: Network, logging and monitoring questions on cyber insurance applications url: "https://insuranceposture.com/questions/network-and-logging" section: Network, logging and monitoring questions: 29 updated: 2026-08-24 --- # Network, logging and monitoring: what cyber insurance applications ask Firewalls, segmentation, remote access exposure, DNS and web filtering, log centralization, retention, and testing regimes. ## 29 questions in this section - [Does the Applicant employ external/perimeter and internal firewalls?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls) (partly verifiable from your tenant) - [Is RDP enabled, and if so, accessible internally only or externally?](https://insuranceposture.com/questions/network-and-logging/rdp-enabled-accessible-internally-only-externally) (verifiable from your tenant) - [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment) (partly verifiable from your tenant) - [Are development, testing, and production conducted in separate environments?](https://insuranceposture.com/questions/network-and-logging/development-testing-production-conducted-separate-environments) (partly verifiable from your tenant) - [Does the Applicant employ intrusion detection/prevention?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-intrusion-detection-prevention) (partly verifiable from your tenant) - [Is IP filtering used to prevent connections from known-malicious addresses?](https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses) (partly verifiable from your tenant) - [Can network ports only be opened with a legitimate business need? Port accessibility regularly verified?](https://insuranceposture.com/questions/network-and-logging/can-network-ports-only-opened-legitimate-business-need-port) (verifiable from your tenant) - [What is the firewall policy: deny all by default, permit by exception?](https://insuranceposture.com/questions/network-and-logging/firewall-policy-deny-by-default-permit-by-exception) (partly verifiable from your tenant) - [How frequently is firewall configuration reviewed and firmware updated?](https://insuranceposture.com/questions/network-and-logging/frequently-firewall-configuration-reviewed-firmware-updated) (partly verifiable from your tenant) - [Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls) (partly verifiable from your tenant) - [How long are audit logs maintained (30 / 90 / 1 year)?](https://insuranceposture.com/questions/network-and-logging/long-audit-logs-maintained) (partly verifiable from your tenant) - [Does the Applicant conduct regular penetration testing? In-house or outsourced?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-penetration-testing-house-outsourced) (attested, not tenant-verifiable) - [Does the Applicant conduct regular vulnerability scans?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-vulnerability-scans) (partly verifiable from your tenant) - [Are independent security audits or assessments performed?](https://insuranceposture.com/questions/network-and-logging/independent-security-audits-assessments-performed) (attested, not tenant-verifiable) - [Does the Applicant have a Security Operations Center (SOC) monitored 24/7?](https://insuranceposture.com/questions/network-and-logging/applicant-security-operations-center-monitored-24-7) (attested, not tenant-verifiable) - [Does local logging happen per-host?](https://insuranceposture.com/questions/network-and-logging/local-logging-happen-per-host) (partly verifiable from your tenant) - [What percentage of hardware/software connected to network is inventoried?](https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried) (partly verifiable from your tenant) - [Are administrative/management login portals restricted from the public internet (closed or limited to specific IP addresses)?](https://insuranceposture.com/questions/network-and-logging/administrative-management-login-portals-restricted-from-public-internet) (partly verifiable from your tenant) - [How is the Applicant's VPN infrastructure hosted (exclusively cloud-based, exclusively on-premises, or hybrid)?](https://insuranceposture.com/questions/network-and-logging/applicant-s-vpn-infrastructure-hosted) (attested, not tenant-verifiable) - [Which VPN provider/product does the Applicant use for remote connectivity?](https://insuranceposture.com/questions/network-and-logging/vpn-provider-product-applicant-remote-connectivity) (attested, not tenant-verifiable) - [Can unauthorized devices be blocked from remotely accessing the network (e.g. MDM, allow-lists)?](https://insuranceposture.com/questions/network-and-logging/can-unauthorized-devices-blocked-from-remotely-accessing-network) (verifiable from your tenant) - [Are protective DNS or DNS filtering services in use?](https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services) (partly verifiable from your tenant) - [Is web gateway technology used to monitor and filter malicious or suspicious URLs?](https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls) (partly verifiable from your tenant) - [Is administrative access to servers restricted to a jump host or a limited number of endpoints?](https://insuranceposture.com/questions/network-and-logging/administrative-access-servers-restricted-jump-host-limited-number-endpoints) (partly verifiable from your tenant) - [Is workstation-to-workstation communication restricted (e.g. RDP between user workstations)?](https://insuranceposture.com/questions/network-and-logging/workstation-workstation-communication-restricted) (attested, not tenant-verifiable) - [Is inbound and outbound traffic to critical servers restricted using an allow-list approach?](https://insuranceposture.com/questions/network-and-logging/inbound-outbound-traffic-critical-servers-restricted-using-allow-list) (partly verifiable from your tenant) - [Is port-level network access control (e.g. 802.1X) used to admit only approved devices?](https://insuranceposture.com/questions/network-and-logging/port-level-network-access-control-admit-only-approved-devices) (attested, not tenant-verifiable) - [Is command-line activity in command shells (e.g. PowerShell, bash) logged and monitored?](https://insuranceposture.com/questions/network-and-logging/command-line-activity-command-shells-logged-monitored) (attested, not tenant-verifiable) - [Are unsuccessful logins to administrative accounts logged and alerted on?](https://insuranceposture.com/questions/network-and-logging/unsuccessful-logins-administrative-accounts-logged-alerted) (verifiable from your tenant) Full index: https://insuranceposture.com/questions --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.