Cyber Insurance Eligibility Estimator

1. Multi-Factor Authentication (MFA) ?

Insurance carriers mandate MFA for all external and administrative connections.

No MFA deployed, or it is optional for users Users log in with usernames and passwords only.

MFA is active on cloud email only MFA protects email (like M365) but is missing on VPNs, local server admins, or key SaaS tools. +15 pts

MFA is enforced on email, remote access, SaaS, and admin privileges MFA is required for all administrative access and remote network portals. +40 pts

2. Endpoint Detection & Response (EDR) ?

Traditional antivirus is no longer sufficient to secure coverage.

No EDR; we use default or legacy antivirus software Standard antivirus that relies on signature updates to detect known malware.

EDR agents are installed, but we monitor alerts internally EDR tool is active, but alerts are only reviewed during standard business hours. +10 pts

Managed EDR (MDR) monitored 24/7 by an active SOC Continuous threat detection with active endpoint isolation capabilities around the clock. +25 pts

3. Backups & Data Isolation ?

Underwriters verify that backups are protected from ransomware propagation.

No automated backup routine, or backups are untested Backups are run ad-hoc or recovery has not been validated recently.

Automated backups exist, but they are connected to our main network Backups run regularly, but share credentials or network paths with active production servers. +10 pts

Backups are isolated, immutable, and tested semi-annually Separated directory/domain hosting with write-once (WORM) configurations. +25 pts

4. Employee Cyber Training ?

Human error is the leading cause of security policy claims.

No formal cybersecurity training for employees Security guidelines are shared ad-hoc or during onboarding only.

Annual security awareness training without phishing tests Employees complete training slides once a year, but phishing alertness is not simulated. +5 pts

Annual training combined with monthly phishing simulations Mandatory awareness training with regular, unannounced email testing and remediation. +10 pts

5. Incident Response Planning ?

Carriers review your breach mitigation readiness to control containment costs.

No written Incident Response Plan (IRP) Breaches would be handled ad-hoc by our IT department or provider.

Written Incident Response Plan exists, but is not tested A draft policy exists but has not been simulated or reviewed in the past year. +5 pts

Written IRP with annual tabletop simulation testing Tested plan with up-to-date communication trees, roles, and insurance coordinator links. +10 pts

1. Multi-Factor Authentication (MFA) ?

2. Endpoint Detection & Response (EDR) ?

3. Backups & Data Isolation ?

4. Employee Cyber Training ?

5. Incident Response Planning ?

High Risk (Declined)

Email My Insurability Report