We'll fill out the cyber insurance application with you.

The largest single block of questions, and the one carriers weight most heavily.

• Multi-factor authentication enforced on the email platform — asked separately from everything else, because email compromise drives most claims.
• MFA on remote access into the corporate network, and on cloud applications.
• MFA protecting all local and remote access to privileged accounts. Partial coverage is a No.
• Whether staff operate under least privilege at all times, rather than holding standing local administrator rights.
• Whether password management software is issued to employees.
• Whether a Privileged Access Management (PAM) tool is deployed. Not yet universal, but increasingly required at higher limits.

Carriers ask what stops a malicious message before a person has to make a judgement call.

• Which controls are applied to inbound email, chosen from a list — you are expected to name them.
• Whether a secure email gateway is in place.
• Whether Office macros are disabled by default. A common quiet No.
• Web filtering that blocks access to known malicious sites.
• Endpoint detection and response coverage, and which product.
• Whether staff are trained to apply extra scrutiny to attachments and links from outside the organisation.

Not just whether backups exist — whether they would survive the event you are insuring against.

• Whether backups are local, offline, offsite, or cloud. Local-only is a weak answer, because ransomware reaches it.
• The specific controls protecting the backups themselves, from a checklist.
• Whether a business continuity plan exists, and whether it has actually been walked through rather than simply written.

Carriers want to know you would notice an intrusion, and know what to do next.

• Whether a SIEM is collecting and monitoring logs.
• Whether a Security Operations Centre covers you, including what hours and whether there is on-call cover outside business hours.
• Whether host-based and network firewalls disallow inbound connections by default.
• Whether an incident response plan exists and is tested annually — the testing is the part most organisations miss.
• Whether a cybersecurity tabletop exercise has been run within the last two years.

The questions that most often expose the gap between what people believe they run and what they actually run.

• Whether an asset discovery tool continuously maps devices on the network.
• Whether the asset database is up to date.
• End-of-life operating systems still in service. Usually the single biggest exposure on the whole application, and the slowest to fix.
• Whether there is a process for decommissioning unused systems.
• What percentage of the network is covered by scheduled vulnerability scanning — answered as a number, so there is nowhere to hide.
• Whether patching extends to third-party applications, not only the operating system.
• How frequently penetration testing is conducted.

The written-policy questions. Low cost to fix, and disproportionately effective on the application.

• Whether a hardened baseline configuration is applied across all or most devices.
• Whether the network is segmented according to data classification level.
• Whether a written data classification policy exists. This can genuinely be one page.
• Whether PowerShell is hardened in line with the practices the carrier names.
• How many machine service accounts hold Domain Administrator privileges — a count, not a yes or no, and one that needs a real audit to answer defensibly.
• Whether a formal vendor management process performs due diligence on third parties.

Process questions rather than technology ones, and usually the cheapest answers to change.

• Whether a request to transfer funds is verified out-of-band before it is actioned.
• Whether a known contact is called back on a known number before a vendor’s bank details are changed.
• These two answers cost nothing but a written procedure and the discipline to follow it.

Machines past their support date cannot be patched, so there is no honest favourable answer available. This is a hardware replacement programme, not a configuration change, which is why it needs the longest lead time of anything on this list.

If everyday accounts hold local admin, the least-privilege question is a No and several related answers weaken with it. Removing standing rights is among the highest-impact changes available.

The application asks for a count. Most organisations cannot produce one without an audit, and an unverified number is exactly the kind of answer that fails scrutiny at claim time.

Heavily weighted by underwriters, inexpensive to put right, and one of the few controls that visibly improves over a policy year.

Having the document is not the question. Annual testing is. A single tabletop session satisfies this and the business continuity question together.

Answered as a percentage, so a gap is unmistakable. Zero is a hard flag and reliably attracts follow-up questions.

Two separate questions, both low effort, both currently No in most organisations we see. These are the quickest wins on the entire form.

Carriers now name specific hardening practices. Applied through Group Policy or Intune this is a configuration change rather than a purchase, and it removes a written explanation from your application.