Cyber insurance readiness
the controls, with evidence.
We review the security controls that cyber insurance questionnaires commonly ask about, using evidence you choose to share, and give you a written report showing which controls you can support with evidence, which are partial and which are missing. It does not arrange, guarantee or price cover.
Who it is for
Organisations that are applying for or renewing cyber insurance, or that want to know which answers they could support with evidence. Insurers’ questions differ, so the review covers common controls and not any one insurer’s form.
What we review
- MFA coverage. multi-factor authentication for email, remote access, privileged and cloud administrator accounts, and where it is missing or bypassed.
- Backups and restore testing. whether backups include an offline or immutable copy and whether restores are tested. CISA’s guidance is to maintain offline, encrypted backups of critical data and regularly test them.
- Endpoint protection. which devices and servers have endpoint protection, which do not, and how alerts are handled.
- Patching and vulnerability management. how quickly updates are applied, which systems are out of support, and how known exploited vulnerabilities are tracked.
- Email security. filtering, anti-phishing settings and SPF, DKIM and DMARC alignment, with a pointer to the email authentication review.
- Privileged access. number of administrators, separate admin accounts, shared accounts and how privileged access is approved and reviewed.
- Incident response plan. whether a written plan exists, who is named, whether it has been exercised, and whether notification and communications steps are included. CISA advises a basic plan that is regularly exercised.
- Remote access exposure. whether remote desktop or other remote services are exposed to the internet. CISA advises against exposing them on the web.
- Logging and retention. what is logged for identity, email and endpoints and how long it is kept.
- Asset inventory and unsupported systems. whether a current inventory exists and which systems no longer receive vendor updates.
- Evidence pack. for each control, the evidence you hold, its date and who owns it, so answers can be supported if you are asked.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A control table: control, status (supported, partly supported, not supported, unknown), evidence and owner
- Findings with severity and the evidence behind each one
- A fix-first list showing which gaps are quickest to close
- A 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over IT security
- The questionnaire or control list you need to answer, if you have one (you complete and submit it yourself)
- Evidence for each control, such as screenshots, policy exports and reports, through an agreed channel
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the evidence in the agreed scope. We do not sign in to your systems.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not arrange, price, guarantee or advise on insurance cover, act as a broker, complete or submit your application, or contact your insurer. Meeting these controls does not ensure cover or any premium.
What needs separate approval. Any change to systems to close a gap, any penetration test, and any follow-up check after changes.
Questions before an enquiry
Will this get us cover or a lower premium?
No. Insurers decide on cover and premiums using their own criteria. The review shows which controls you can support with evidence and which gaps to close; it guarantees nothing about cover or price.
Do all insurers ask the same questions?
No. Questions and required controls differ between insurers and change over time. The review covers commonly asked controls; you should compare against your own form.
Will you fill in our insurance application?
No. You complete and submit it. We help you understand which answers you can support with evidence.
Can we show the report to our insurer?
That is your decision. The report is written for you and says what was and was not checked; confirm with your insurer or broker what they accept.
Are you an insurance broker or adviser?
No. We review IT controls only and give no insurance advice.
Free tools, reading and vendor documentation
- Email domain health score (free)
- Phishing-resistant MFA and fake sign-in pages
- Windows Server 2016 end-of-support guide
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.