Cyber Insurance Requirements and How to Actually Meet Them

Cyber insurance applications have become security audits. The questionnaire asks about MFA, backups, EDR, patching and email filtering, and the premium and even the availability of a policy depend on the answers. The part people miss is that the answers are warranties. If you say MFA is enforced on all remote access and a claim reveals it was not, the claim can be denied.

Here is what the common questions actually mean, how to meet each one, and how to keep the evidence.

The questions every carrier asks

Forms differ, but the controls they probe are the same across carriers because they map to how ransomware claims happen. Read each question as 'is this control enforced everywhere, and can you prove it', not 'do you have this somewhere'.

• MFA on email, on remote access (VPN, RDP, remote tools), and on privileged accounts. 'Enforced' means a policy blocks login without it, not that users were asked to enroll.
• Endpoint detection and response on all endpoints and servers, with someone monitoring it.
• Backups that are offline or immutable, encrypted, tested, and separated from the domain.
• Email filtering with attachment sandboxing and link protection, plus SPF, DKIM and DMARC.
• Patching cadence for critical vulnerabilities, often with a stated window such as 30 days, and end-of-life systems isolated or removed.
• Privileged access management: separate admin accounts, no shared admin credentials, local admin rights removed from users.
• An incident response plan that exists in writing and has been exercised.

Turning a yes into a true yes

For each control, the honest test is whether an auditor pulling the configuration would see enforcement. Here is the evidence to be able to produce for the questions that most often turn out to be answered optimistically.

1. MFA: export the Conditional Access policies from Entra ID and the list of users without a registered method (Entra admin center > Protection > Authentication methods > User registration details). Screenshot the VPN's authentication settings showing RADIUS or SAML with MFA.
2. EDR: export the device list from the EDR console and reconcile against Active Directory and Intune. Unprotected devices are the gap.
3. Backups: a screenshot of the Object Lock or immutability setting on the repository, the retention policy, and the log of the last restore test with date and duration.
4. Email: the DMARC record at p=reject and the Defender for Office 365 Safe Links and Safe Attachments policies.
5. Patching: a vulnerability scan report from before and after the monthly window, or the WSUS/Intune compliance report.
6. Privileged access: the Domain Admins group membership, small and named, and a LAPS report showing rotation.
7. Incident response: the plan document with a version date, and the tabletop exercise notes.

# Users with no MFA method registered (Graph PowerShell)
Connect-MgGraph -Scopes 'UserAuthenticationMethod.Read.All','AuditLog.Read.All'
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { -not $_.IsMfaRegistered } |
  Select-Object UserPrincipalName, IsAdmin, LastUpdatedDateTime

The ones that trip people up

Three questions are answered wrong more than the rest, and each has cost someone a claim.

• 'Is MFA enforced for all remote access?' The VPN has MFA. The old RDP forward for the accounting vendor does not. The remote support tool the MSP uses does not. All remote access means all of it, including third parties.
• 'Are backups disconnected from the network or immutable?' A NAS on the LAN with a backup share is neither. The backup server being domain joined with a Domain Admin service account fails the spirit of the question even if a cloud copy exists.
• 'Do you have end-of-life software in the environment?' The one Windows Server 2012 box running the label printer counts. Either isolate it with documented compensating controls or replace it, and say which on the form.
• 'Is there a shared administrator password?' If every workstation was imaged with the same local admin password, yes. LAPS is the fix and the evidence.

Keep the evidence current

The application is a snapshot; the policy is a year long. Controls drift. A new hire skips MFA enrollment, a vendor gets a temporary RDP forward that becomes permanent, the backup repository's lock is turned off to free space. At claim time the carrier looks at the state on the day of the incident, not the day of the application.

Put a quarterly check on the calendar. Re-run the same exports, compare them to last quarter, fix what moved. Keep the exports in a folder outside the production tenant so they survive an incident. And if a material change happens, such as a merger, a new remote access tool or a change of IT provider, tell the broker rather than waiting for renewal.

• Quarterly: MFA registration report, EDR coverage reconciliation, backup immutability screenshot, restore test log entry.
• Annually: tabletop exercise, incident response plan review, external vulnerability scan, training completion.
• On change: new remote access tools, new public services, new vendors with access, changes to backup storage.

Frequently asked questions

Takeaway

Read every question as a warranty, meet it with an enforced control rather than a policy on paper, and keep the evidence somewhere an incident cannot reach. Then check it quarterly. The application is the cheapest security assessment you will ever get, provided the answers are true.