Is Multi-Factor Authentication (MFA) required for:
Insurers treat MFA as table stakes. Any gap on this list is the question that gets asked first — and rejected on first.
Are critical security patches applied within 30 days for:
Most denied cyber claims involve a vulnerability that had a patch available more than 30 days before the breach.
Are critical backups kept offline or segregated from production:
If ransomware can reach your backups, you don't have backups. Insurers want to see at least one isolated copy.
Are your backups encrypted, MFA-protected and tested:
Encryption protects data at rest; MFA stops an attacker with admin creds from wiping recovery; a test proves the restore actually works.
Are payee and banking changes verified out-of-band for:
Catches the most common forms of invoice and CEO fraud — bad actor emails 'updated bank details' and gets paid.
Is dual-authorisation required for:
Two-person rule on sensitive money moves. Required by most policies that cover funds-transfer fraud.
Is security awareness training in place for:
Quarterly micro-training plus simulated phishing is the gold standard. Insurers increasingly ask which platform you use.