The person who signs a cyber insurance application is usually the owner, not the IT person. That signature says the answers are true. If they are not, and you later file a claim, the insurer has grounds to contest it. So the questionnaire deserves more than a fast pass of checking Yes on every line. Our earlier post on why Washington small businesses need cyber insurance covers whether to buy a policy. This one covers filling out the form.
Applications differ by carrier, but most ask about the same set of controls. Below is what each question usually means in plain terms, what a truthful yes requires, and the proof to export and keep. Answer truthfully, keep the evidence, and go over your answers with your broker before you sign. This is practical IT guidance, not legal advice.
Build a Proof Folder First
Make one folder that more than one person can reach, named for the policy year. Every time you export a report or take a screenshot below, save it there with the date in the filename. At renewal or claim time, you hand over a folder instead of rebuilding a year of settings from memory.
The questions are not arbitrary. They track the basics that government agencies publish for small organizations. CISA’s Cyber Essentials, written for leaders of small businesses, covers MFA, backups with offline copies, staff training, and an incident response plan. CISA’s Cross-Sector Cybersecurity Performance Goals 2.0 were updated to align with NIST CSF 2.0 and added goals on managed service provider risk and least privilege. NIST’s small business cybersecurity center also keeps a cyber insurance page that points to guidance on choosing a policy.
The Common Control Areas
| Question area | What a yes requires | Proof to keep |
|---|---|---|
| MFA | Every user on email, every remote access path, every admin account | Entra user registration details, Conditional Access policy screenshots |
| EDR | An agent on every company PC and server, reporting to a console | Defender device inventory CSV export |
| Backups | An offline or immutable copy, and a restore you have actually tested | Backup job history, dated restore test notes |
| Patching | Security updates applied promptly on PCs, servers, firewalls and VPNs | Intune Windows Updates report, firewall firmware screenshots |
| Admin accounts | Separate admin accounts, few of them, all with MFA | List of admin role holders and their owners |
| Remote access | No Remote Desktop open to the internet, MFA on the VPN | Firewall port forwarding rules, VPN MFA setting |
| Email security | Filtering in place and a DMARC record that enforces | DMARC DNS lookup, filtering policy screenshots |
| Training | Every employee trained, often with phishing simulations | Completion records with names and dates |
| Incident response | A written plan with roles and contacts that people have walked through | Dated plan, contact list, exercise notes |
| Vendor access | A known list of outside parties who can reach your systems | Vendor access list with sign-in method and MFA status |
What Each Question Is Really Asking
Multifactor Authentication
Most forms split this into email, remote access, and admin accounts, and they mean every account in each group. In Microsoft 365, browse to Entra ID, then Authentication methods, then Activity. The Registration tab shows how many users are capable of MFA, and the User registration details list shows each user with an MFA Capable column. Capable is only half the answer, so also keep screenshots of the Conditional Access policies that require MFA, found under Entra ID, Conditional Access, Policies.
Endpoint Detection and Response
An EDR question asks whether every company PC and server runs a detection and response agent that reports to a console someone watches. With Microsoft Defender for Endpoint, the device inventory under Assets, then Devices in the Defender portal lists each device with its onboarding status. The Export button at the top saves a CSV of every device. Compare it against the computers you own.
Backups
Insurers want to know whether backups are separate from your network, whether an attacker could delete them, and whether you have restored from them. CISA’s ransomware guide tells organizations to keep offline, encrypted backups of critical data and to regularly test their availability and integrity. Keep the backup job history, a note on which copy is offline or immutable, and a dated record of your last test restore.
Patching
This asks whether operating systems and software get security updates promptly, including firewalls and VPN appliances nobody logs into until something breaks. For Windows PCs managed by Intune, the update reports live under Reports, then Windows Updates in the Intune admin center. Save a copy, and add a screenshot of the firmware version page on each firewall.
Privileged and Admin Accounts
A truthful yes means admins do admin work from a separate account, and there are few of them. CISA’s ransomware guide says to separate administrator accounts from user accounts and use designated admin accounts only for admin tasks. Microsoft recommends giving the Global Administrator role to fewer than five people. Keep a screenshot of who holds admin roles and a note on who owns each account. Shared local admin passwords on PCs count against you too, and Windows LAPS gives every PC its own.
Remote Access Exposure
If Remote Desktop is reachable from the internet, expect that answer to matter. CISA recommends limiting RDP, auditing the network for systems that use it, closing unused RDP ports, and applying MFA. A truthful answer here means remote access goes through a VPN or another gateway that requires MFA. Keep a screenshot of the firewall’s port forwarding rules showing nothing pointed at port 3389, plus the VPN’s MFA setting.
Email Security
This covers spam and phishing filtering plus domain authentication. A DMARC record is a TXT record at _dmarc on your domain that tells receiving servers what to do with mail that fails the check. Microsoft describes p=none as the value for testing and tuning, while p=quarantine and p=reject tell receivers to act. Save a DNS lookup of your DMARC record and screenshots of your filtering policies.
Security Awareness Training
A yes usually means every employee gets security awareness training, and many forms ask about phishing simulations. Microsoft’s Attack simulation training in the Defender portal requires Defender for Office 365 Plan 2. Whatever tool you use, keep completion records with names and dates.
Incident Response Plan
The question is whether a written plan exists and whether people know it. CISA’s Cyber Essentials tells leaders to develop an incident response and disaster recovery plan that outlines roles and responsibilities, to test it often, and to know who to call for help. Keep the dated plan, the contact list with your insurer’s claim reporting number, and notes from your last walkthrough.
Vendor and Third-Party Access
This asks who outside your company can get in: your IT provider, software vendors with remote support tools, an accountant with a login. Cyber Essentials tells organizations to keep inventories of network connections, including vendors and business partners. Keep a list of each vendor, what they can reach, how they sign in, and whether MFA is on.
What to Ask Your IT Person
Can you show me the MFA report? Ask for the user registration details and walk the list together. Any account that is not MFA capable is a no until it is fixed.
Which devices are missing EDR? The inventory export compared against your asset list answers this in one sitting.
When did we last restore from backup? If the answer is a guess, schedule a test restore before you sign.
Is anything open to the internet that should not be? Ask specifically about Remote Desktop and old VPN appliances.
Who has admin rights, and who has outside access? Get names, not counts.
For an outside check of your Microsoft 365 settings, our roundup of free Microsoft 365 security audit tools covers options that produce reports you can drop straight into the folder.
Admins moving to phishing-resistant MFA can start with FIDO2 security keys, which Entra ID supports for passkey sign-in.
Related Posts
Washington’s 30-Day Breach Rule and Why Your SMB Needs Cyber Insurance
Best Free Password Managers for Small Business in 2026
Best Free Microsoft 365 Security Audit Tools for 2026
Need help getting your cyber insurance answers and proof in order? Contact Rain City Techworks.