Cyber insurance applications: the website and email questions

Questions that come up often

Exact questions vary by insurer. This isn’t insurance or legal advice; your broker can tell you how your policy treats each answer.

• Is multi-factor authentication required on email, remote access and administrator accounts?
• Do you filter incoming email and authenticate outgoing email (SPF, DKIM, DMARC)?
• Are backups kept offline or separate from your main systems, and tested?
• Are critical security updates applied within a set time?
• Do you have a written procedure for verifying payment or bank detail changes?
• Do you have an incident response plan, and who would you call?

Getting to an honest yes

1. Two-step sign-inOn every mailbox and admin account, not just the owner’s. Our guide on which accounts to protect first covers the order.
2. Email authenticationSPF and DKIM for every sender, and DMARC enforced, not just p=none. Our email check shows where you stand.
3. BackupsWebsite and business data backed up somewhere separate, with a restore tested and the date written down.
4. UpdatesA routine, written down: who updates what and how often.
5. Payment verificationA one-paragraph rule that any change in bank details is confirmed by phone on a known number.
6. Incident planOne page: who to call, in what order, for a hacked site, a taken-over mailbox and a ransomware note. Our printable who-to-call card is a start.