Insurers now ask detailed security questions before quoting, and the answers become part of the policy. A "yes" you can't prove after a ransomware attack is a reason to reduce or refuse the claim. Check each control and the evidence behind it.
Short answer: insurers mostly ask for MFA on email, remote access and admin accounts, EDR on every endpoint, offline or immutable backups with tested restores, timely patching, an incident response plan, and security awareness training. Having the control is not enough; you need dated evidence that it was in place when the incident happened.
Free, runs in your browser. Nothing you enter is sent or stored. Updated: .
0%
Missing controls first, then controls you have but couldn't prove today.
What to fix or document
Based on common insurer questionnaires and public market reports. Each insurer's wording and requirements differ; read your own proposal form and policy. Not insurance or legal advice.
Questions
Why does evidence matter if the control is in place?
After a claim the insurer's forensics team checks whether the controls you declared were actually working. Without logs, reports or dated tests you can't show that, and a misrepresentation in the proposal form can reduce or void the payout.
Do insurers accept SMS codes as MFA?
Many insurers still accept any MFA, but more of them ask specifically about phishing-resistant methods for admins and remote access. Moving admins to FIDO2 keys or passkeys improves both security and the answers on the form.
Should I call my IT provider or the insurer first after an attack?
Check your policy now: most cyber policies have a breach hotline and panel firms for forensics and legal help, and using your own suppliers without approval can limit what is covered. Put the hotline in your incident response plan.
We help you answer the insurer's questionnaire accurately and build the evidence pack behind each answer: MFA coverage, EDR reports, restore tests and the incident plan.