The checklist
General, not any one insurer's form: carriers word the questions differently and add their own. For each control the honest answer is yes, no or not sure, and the insurer may ask you to show it.
-
1
Multi-factor sign-in
On email, remote access and every administrator account, with no exceptions.
-
2
Endpoint detection and response (EDR)
On every computer and server, with someone watching the alerts.
-
3
Backups you can restore
Kept offline or immutable, encrypted, and restored in a test at least once a year.
-
4
Patching
Critical updates on computers, servers and firewalls within a set number of days, and no unsupported systems.
-
5
Email security
Filtering for phishing and malware, and SPF, DKIM and DMARC set up on your domain.
-
6
Security awareness training
For all staff, with phishing tests to check it is working.
-
7
Separate admin accounts
Administrator rights kept on separate accounts from everyday ones, and only for the people who need them.
-
8
Secure remote access
Through a secure gateway, never remote desktop open to the internet.
-
9
An incident response plan
Written down: who to call, and what happens in the first hour.
-
10
Payment verification
A call-back to a known number before any change to bank details or any wire transfer.
Anything you can't answer yes to, with proof, goes on the list to fix before you sign.