Cyber insurance questions, in plain English

The 10 questions

Tick what you have today. Anything you can't tick is worth fixing before you sign the application.

The insurer asks	What it means	You have it?
Is multi-factor authentication (MFA) required for email and remote access?	A second step after the password whenever anyone signs in from outside	☐Tick if you have it
Do admin accounts use MFA and separate logins?	Admin rights only on separate admin accounts that also need MFA	☐Tick if you have it
Do you run EDR (endpoint detection and response) or anti-malware on every device?	Protection that is installed, kept updated and watched	☐Tick if you have it
Are backups offline or immutable, and tested?	A copy ransomware can't reach, and proof it restores	☐Tick if you have it
How quickly are critical patches applied?	Windows and common apps updated automatically, on a schedule	☐Tick if you have it
Do staff get phishing training?	Short training plus test emails	☐Tick if you have it
Do you keep an inventory of devices and software?	You know what's on your network	☐Tick if you have it
Do you have an incident response plan?	Who to call, and what to do first	☐Tick if you have it
Do you filter email and use DMARC?	Spoofed and harmful email blocked before it reaches anyone	☐Tick if you have it
Do you run any end-of-life systems?	No software the vendor no longer supports	☐Tick if you have it

A plain-English guide, not legal or insurance advice. Your insurer's form decides the exact questions.

Get the Readiness Assessment

CYOPS IT · Readiness Assessment · (800) 619‑5494 · info@cyopsit.com · cyopsit.com