Cyber insurance readiness checklist

Underwriters decide on cyber coverage, and its price, largely from the security controls you have in place. This checklist walks through 25 of them so you can see your gaps before an application asks. It is a preparation tool. It is not what any insurer uses to score you.

How to use it

Answer each question yes, partly or no, based on what is true today and not on what a policy or a vendor brochure says. Your IT provider or managed service provider can confirm items like multi-factor authentication coverage, endpoint tools and backup settings. The 25 questions fall into six groups:

• Identity and multi-factor authentication (5): MFA on email, remote access and administrator accounts, unique accounts and prompt removal of departing users.
• Devices and patching (6): endpoint detection and response, a patch schedule, no end-of-life systems, no Remote Desktop open to the internet, no everyday administrator rights, encrypted laptops and phones.
• Backups (3): regular backups, one copy offline or immutable, and a restore test in the past year.
• Email and payments (4): email filtering, SPF/DKIM/DMARC, phone call-back for new payees or changed bank details, and two-person approval of large wires.
• People (2): annual awareness training and phishing tests.
• Planning and vendors (5): a tested incident response plan, knowing who to call first, a data inventory, vendor vetting and a plan to run for a week without your systems.

Each control carries a one-line reason, and 17 of the 25 carry a Commonly asked tag. That tag is this site's judgment of what applications frequently ask. It is not drawn from one insurer's form. The Save button keeps your answers on your device only, and Clear and Print are beside it.

The math

A yes counts 1 point, partly counts 0.5, and no or unanswered counts 0. The readiness score is the points divided by 25. The group bars use the same rule within each group. The gap list shows every partly and no answer, with the commonly asked controls first.

A hypothetical example: 15 yes, 6 partly and 4 no gives (15 + 3) ÷ 25 = 72%.

Assumptions and limits

• Every control is weighted equally. Open Remote Desktop or no MFA on remote access matters far more to an underwriter than missing phishing tests, so read the gap list, not just the percentage.
• A high score does not guarantee you can buy coverage or that a claim will be paid. Each insurer sets its own requirements, and the answers on your application must be accurate. Inaccurate answers can put a claim at risk.
• On a real application, "partly" usually has to become a specific answer, such as MFA on email but not on remote access. Work out which systems are covered.
• The checklist leaves out revenue, industry, the volume of sensitive records you hold and your claims history, which also drive price.
• It cannot test your systems. It records what you tell it.
• Nothing leaves your browser, and answers are stored only if you press Save.

Start with MFA, EDR and backups: the controls cyber insurers now require for how underwriters treat each control, then see the cyber insurance application: what underwriters ask and how to answer for the questions themselves. Backups and an incident plan are covered in ransomware and cyber insurance: how claims work and building an incident response plan your insurer will like. The glossary defines multi-factor authentication and business email compromise.