Free tool · about 5 minutes

Will your cyber insurance renewal go smoothly?

Answer 20 questions, phrased the way carriers ask them, and see your readiness score and the answers most likely to cause trouble. Then get a PDF with suggested answers and the evidence to keep on hand.

Start the check

About your organization

Identity & access

Do you require multi-factor authentication (MFA) for all email access, including webmail and phones?Often required
Is MFA required for all remote access to your network (VPN, remote desktop, cloud admin portals)?Often required
Is MFA required for all administrator and privileged accounts?Often required
Do everyday users work without local administrator rights on their computers?
Do employees use a company password manager, and do you monitor for leaked company credentials?

Devices & patching

Do all computers and servers run endpoint detection and response (EDR), not just traditional antivirus?Often required
Are critical security patches applied within 30 days (or faster for actively exploited flaws)?Often required
Have you retired or isolated all unsupported systems (for example Windows 10 after support ends, old servers)?

Email & people

Do you filter inbound email for phishing and malicious attachments, and have DMARC set to quarantine or reject?

Not sure about DMARC? Check your domain in 10 seconds ↗

Do employees get security awareness training at least annually, with simulated phishing tests?Often required
Do you verify any request to change bank details or send a payment by calling a known number before acting?

Backup & recovery

Are backups of critical data kept offline, immutable or otherwise separated so ransomware can’t encrypt or delete them?Often required
Have you tested restoring from backup in the last 12 months?
Do you back up Microsoft 365 or Google Workspace (email, OneDrive, SharePoint) with a separate service?

Detection & response

Are security alerts monitored 24×7 by a security operations center (SOC) or MDR service?
Do you have a written incident response plan that has been reviewed or tested in the last year?
Is your office network protected by a managed, supported firewall with current security subscriptions?

Governance & vendors

Do you have written security policies and someone accountable for security (internal or a vCISO)?
Do you review the security of vendors who hold your data or can access your systems?
Do you keep an up-to-date inventory of computers, servers and cloud services?

What carriers look for

Cyber insurance applications have become security audits. Underwriters want proof of multi-factor authentication, endpoint detection and response, backups that ransomware can’t reach, timely patching and real security training. Gaps can mean a declined application, exclusions, a lower limit or a much higher deductible.

Common questions

What security controls do cyber insurers require?

Most carriers now treat a core set of controls as conditions of coverage: multi-factor authentication on email, remote access and admin accounts; endpoint detection and response (EDR) on every device; backups that ransomware cannot reach; timely patching; and ongoing security awareness training with phishing tests.

What happens if I answer an insurance application incorrectly?

An inaccurate answer can let the carrier deny a claim or rescind the policy. Always answer based on the controls you actually have, and tell your broker about gaps and your plan to fix them.

Is this check insurance advice?

No. It is general guidance to help you prepare. Your broker or carrier decides what their questions mean and what they require.

Does Forte help with insurance questionnaires?

Yes. For clients we implement these controls, keep the evidence from the systems we manage, and help complete cyber insurance questionnaires at renewal.

Related: Cyber insurance readiness · Cyber Security Insurance and Requirements · Free email security check

Talk to an engineer, not a call center.

We answer during business hours and reply to web inquiries in under 15 minutes.

510-854-5920 Send a message