Cyber-insurance questionnaire prep

Renewals increasingly ask whether you actually do these things — and "sort of" raises your premium or voids a claim. Work down the list; anything you can't tick is a gap worth closing before you sign.

Identity & access

• MFA everywhere — multi-factor on email, remote access, admin accounts and finance tools.
• Individual accounts — no shared logins; each person has their own.
• Offboarding works — access is removed the day someone leaves (test a recent leaver).
• Admin rights are limited — only the people who need them, reviewed quarterly.

Devices & email

• Endpoint protection / EDR on every computer, centrally monitored.
• Patching — operating systems and apps updated on a schedule, not "when we remember."
• Email filtering for phishing and malware, plus staff awareness training.

Backup & recovery

• Offsite backups separate from production, encrypted.
• Immutable / write-once copies so ransomware can't rewrite them.
• Restore tested — you've actually restored in the last quarter (not just "it's backing up").
• Documented recovery plan with a realistic recovery-time expectation.

Network & sites

• Segmentation — one compromised site/account can't reach the whole business.
• No legacy shared VPN as the only control; access granted per resource.
• Consistent setup across all locations (same standard, documented).

Governance

• Incident response — who to call, in what order, written down.
• Vendor list — you know which third parties hold your data.
• An owner — someone (internal or a vCIO partner) owns IT decisions and the roadmap.