What your cyber insurance questionnaire is really asking
Every renewal, someone at the firm, often the office manager or managing partner, gets a cyber insurance application full of yes/no questions about MFA, backups, and endpoint protection. It's tempting to check "yes" and move on. A better approach is to understand what each question is getting at, answer it accurately, and treat the gaps as a to-do list.
Questionnaires differ by carrier and change over time, so read yours carefully. Below are themes that commonly appear and the plain-English question behind each one.
"Do you require MFA for email, remote access, and administrative accounts?"
What they're asking: If someone steals a password, can they get in with only that password?
The honest answer depends on the details. Is MFA enforced for every user, or just available? Are there exceptions? Does it cover remote access to your network, cloud apps, and admin accounts, not only Outlook? If one service account or one partner is excluded, say so and fix it. CISA's MFA page is a useful plain-language reference.
"Do you maintain backups that are separate from your network, and are they tested?"
What they're asking: If ransomware encrypted everything, could you restore, and how do you know?
Ask your IT provider three things. What is backed up (including Microsoft 365 mail and files, which many firms assume are covered)? Is at least one copy protected from being deleted or encrypted by someone who gains access to your network? When was a restore last tested? "We have backups" and "we restored a full mailbox last quarter" are very different answers.
"Do you use endpoint detection and response (EDR) on all devices?"
What they're asking: Would anyone notice suspicious activity on a laptop or server, and respond?
This is about more than antivirus. If your IT provider manages this, ask what product is used, whether it covers every device (including the laptop a partner uses at home), and who looks at alerts, including after hours.
"How do you manage privileged access?"
What they're asking: How many keys to the kingdom exist, and who holds them?
Count the admin accounts in Microsoft 365 and on your network. They should be few, named, protected with MFA, and separate from everyday accounts.
"Do you patch systems and software on a regular schedule?"
What they're asking: Are known holes closed in a reasonable time?
Ask your IT provider how updates are applied to computers, servers, firewalls, and remote-access equipment, and whether anything is too old to receive updates.
"Do you train employees and verify payment requests?"
What they're asking: Could a convincing email talk someone into sending money or credentials?
For law and accounting firms, changes to wiring instructions are a common pressure point. A written rule, such as "verify any change in payment details by calling a known number, never the number in the email," is often worth as much as any tool.
"Do you have an incident response plan?"
What they're asking: If something happens on a Friday night, does anyone know the first three calls to make?
A short document listing who to call (your IT provider, your insurer's claims line, outside counsel), who decides, and where contact details are kept offline is a solid start. Many policies have specific notification steps, so check yours.
How to answer well
- Be accurate, not optimistic. If the true answer is "mostly" or "in progress," say so and explain. Your broker can tell you how your policy treats inaccurate answers.
- Get the facts from the people who run the systems. Have your IT provider review technical answers before you submit.
- Keep a copy of what you submitted and the evidence behind it, so next year is easier.
- Use the gaps. The questions you couldn't answer confidently are a reasonable starting list for your next IT planning meeting.
For a broader baseline, CISA's Cyber Essentials is written for small organizations and maps well to the topics these questionnaires cover.
About Switchback Cyber. If you'd like help understanding where your Microsoft 365 environment actually stands before you answer, Switchback Cyber offers a fixed-scope, read-only review with evidence for each finding and a prioritized plan for your IT provider. Switchback doesn't fill out questionnaires for you or sell insurance or tools; it helps you answer from facts. More at switchbackcyber.com.