HowyGuardCyber insurance security checklist: how to set up each item
Cyber insurance forms ask about the same dozen or so security items. Work down this list: for each item, check whether you already have it, set it up with the linked guide, and save a dated screenshot or note as proof. Then answer each question on your form with what's actually in place.
This is every security item a cyber insurance form is likely to ask about, with a guide for each. If a word on your form is new to you, the glossary explains it.
Running a counselling business or a clinic? Start with the shorter lists for therapists and counsellors or chiropractic and physiotherapy clinics.
1. Two-step sign-in on every email account
Every inbox, including shared ones and accounts for people who've left, needs a second step after the password, and staff can't skip it. How to turn on MFA for email, or go straight to Google Workspace or Microsoft 365.
2. Admin accounts and remote access
Keep admin accounts to one or two people with two-step sign-in, and turn off remote access nobody uses. How to secure admin accounts and remote access.
3. A backup you unplug
A copy of your files your computers can't reach. How to set up an offline backup and tell if yours counts, and backups for OneDrive and Google Drive.
4. A restore test
Pull a few files back out of the backup and check they open. How to test your backups.
5. Antivirus or EDR on every computer
How to check your antivirus and set up EDR.
6. Updates on every computer
How to turn on automatic updates on Windows and Mac, and what to do about Windows 10 computers.
7. Email filtering and DMARC
How to set up email filtering and DMARC, with DMARC guides for Google Workspace and Microsoft 365.
8. Encryption
How to turn on FileVault or BitLocker and encrypt your data.
9. Yearly staff training
How to set up security and phishing training.
10. A one-page incident response plan
How to write an incident response plan.
11. A list of outside companies with access
How to control what outside companies can access.
12. A call-back rule for payments
How to verify payment requests and bank detail changes.
13. Proof for each item
One folder, one dated screenshot or note per item. How to save proof.
Not sure about an answer?
Don't guess. How to check the answer to a question shows where to look and what to ask your IT provider. HowyGuard never signs a form for anyone.
What each question means
How do I check my antivirus and set up EDR?
On Windows, open Windows Security and check real-time protection, cloud protection and tamper protection are on. On a Mac, turn on the automatic security updates that keep its built-in protection current. If your form asks for a paid product or EDR, a tech can install one, such as Microsoft Defender for Business, on every computer.
How do I control what outside companies can access?
Make a list of every outside company or person who can log in to your computers, email or business software, like your IT helper, software vendors or web designer. Give each one their own login with two-step sign-in, remove anyone you no longer work with, and keep the dated list as proof.
How do I encrypt my computers and business data?
Turn on BitLocker or Device encryption on every Windows computer and FileVault on every Mac, save each recovery key away from the computer, set a passcode on every phone with work email, and encrypt backup drives. If your form also asks about servers or data files, ask whoever holds your business records, in writing, whether they're encrypted.
How do I keep every computer patched and up to date?
Turn on automatic updates on every Windows and Mac computer, update your apps, and check each computer once a month says it's up to date. Write down the check dates. Any computer that can no longer get updates, like one still on Windows 10, goes on its own list so you can replace it or describe it honestly.
How do I secure admin accounts and remote access?
Cut your admin accounts down to one or two people and make sure each uses two-step sign-in. Then turn off Remote Desktop, screen sharing and remote-control tools nobody uses, and turn on two-step sign-in for any you keep, including a VPN. Keep dated screenshots of the admin list and the remote access settings.
How do I set up an offline backup?
Keep a copy of your files that your computers can't reach: a drive you unplug after each backup, or a backup service built for the job. Files on your computers go to a drive with File History or Time Machine. Files in Microsoft 365 or Google Workspace need a backup service or a regular export.
How do I set up email filtering and DMARC?
Google Workspace and Microsoft 365 already filter email for spam and malware. Turn on their extra protections: Gmail's Safety settings, or Microsoft's Standard preset policy. Then set up SPF, DKIM and DMARC on your domain so nobody can easily send email as you. Save dated screenshots of each.
How do I set up yearly security and phishing training?
Pick a short security course, such as the free material on Get Cyber Safe, and have everyone who uses business email finish it once a year, including you. Keep a log of each name, course and date. If your form asks about phishing tests, add a test service that sends a harmless fake email.
How do I turn on MFA for every email account?
Turn on two-step sign-in, also called MFA, for every email account the business uses, and make it required so nobody can skip it. Shared inboxes and accounts for people who left count too. Google Workspace and Microsoft 365 can require it for everyone at once; a personal Gmail or Outlook.com address is set up one by one.
How do I verify payment requests and bank detail changes?
Write one rule: before paying a new account or changing anyone's bank details, phone them on a number you already had, never one from the email asking. Log each call. For larger payments, have a second person approve before money moves, if you can. Keep the rule and the log as proof.
How do I write an incident response plan?
Write one page called If we get hacked. List who to call first, including your insurer's incident line from your policy, how to stop the damage, where your backups are and who can restore them. Print it, keep a copy away from the computers, read it through with your staff once a year, and date it.
How-to guides
How do I set up DMARC for Google Workspace?
DMARC is a TXT record named _dmarc in your domain's DNS settings, not a switch in the Google Admin console. Set up SPF and DKIM first, then add a DMARC record with p=none and an inbox you read. Once your real email keeps arriving normally, change it to p=quarantine and keep a dated check result.
How do I set up DMARC for Microsoft 365?
For your own domain, Microsoft 365 has no DMARC switch: you add a TXT record named _dmarc wherever your domain's DNS lives. Set up SPF, turn on DKIM signing for your domain in the Defender portal, then add DMARC with p=none. Once your real email arrives normally, change it to p=quarantine and keep a dated check result.
How do I turn on MFA in Google Workspace?
In the Google Admin console, open Security, then Authentication, then 2-Step Verification. Pick your top organizational unit, allow it, and set enforcement to start on a date about a week away so staff can enrol. After that date, confirm every admin is enrolled and take a dated screenshot of the setting and the user list.
How do I turn on MFA in Microsoft 365?
Turn on security defaults in the Microsoft Entra admin center, under Entra ID, Overview, Properties. Microsoft then has every user register for two-step sign-in, usually with the Authenticator app, and requires it for admins. Staff are asked at their next sign-in. Keep a dated screenshot of security defaults showing Enabled, plus the list of who has registered.
Questions people ask
Cyber insurance checklist for chiropractic and physiotherapy clinics
Give every staff member their own login with two-step sign-in, on email and on your clinic system. Then encrypt and update every computer, check antivirus, keep a backup you unplug, set up DMARC, list outside logins, use a call-back rule for payments and train staff yearly. Each item below links to the steps.
Cyber insurance checklist for therapists and counsellors
Set up two-step sign-in on your email and your notes system, encrypt your laptop, turn on automatic updates, check your antivirus, keep a backup you unplug, set up DMARC on your email domain, and list anyone outside who can log in. Each item below links to the steps, and to how to save proof it's done.
How do I add a real backup to OneDrive or Google Drive?
OneDrive and Google Drive sync your files, so a deleted or scrambled file syncs everywhere. To have a real backup, add a backup service built for Microsoft 365 or Google Workspace, or export your files regularly to a drive you unplug. Protect the backup's admin login with two-step sign-in and keep a screenshot of the last backup.
How do I check the answer to a question on my cyber insurance form?
Don't guess. Check the setting yourself using the table below, or send the exact question to your IT provider in writing and ask for a dated screenshot. If the true answer is partly, fix the gap first or tell your broker exactly what's in place. Your answers need to be true when you sign.
How do I prepare for my cyber insurance renewal questionnaire?
Start from last year's answers. Re-check every yes against how your business is set up today, fix any gaps before the renewal date, and keep dated proof for each control, such as a screenshot or a log. That way the renewal form you sign is true on the day you sign it, not just last year.
How do I save proof that each security setting is done?
Make one folder for the policy year. As you finish each setting, take a screenshot that shows the setting turned on, which computer or account it's for, and the date. For things that aren't settings, like training or payment checks, keep a dated note or log. Leave client details and passwords out.
How do I test my backups?
Pick three files you use, restore them from your backup into a new folder, and open each one to check it looks right. Write down the date, what you restored and whether it worked. Do it at least once a year, or as often as your form asks, and keep the notes in one file as proof.
What are the cyber insurance requirements for a small business in Canada?
There's no single national list in Canada. Each insurer writes its own application form. Canadian forms commonly ask about MFA on email, backups, endpoint protection, updates, email filtering, encryption and staff training, and the Canadian Centre for Cyber Security's baseline controls for small businesses cover much the same ground.
What do I do about Windows 10 computers?
Windows 10 stopped getting regular security updates on October 14, 2025. Find every computer still running it, upgrade each one to Windows 11 if it can run it, and replace the ones that can't. If you have to keep one for now, write down what it's for and ask a tech to keep it apart from your other computers.
What happens if I answer my cyber insurance application wrong?
The form you sign says your answers are accurate and complete. Many applications also say that if anything in them isn't correct, the insurer can treat the insurance as if it never existed. In one public US case, an insurer and its customer agreed to void a policy over an MFA answer. Tell your broker, and fix the gap.
Who should fill out and sign the cyber insurance application?
A senior person at the business signs it, usually the owner, a partner or a director. Many forms say the signer must have made reasonable inquiry, meaning they asked the people who would know. Your IT provider can help gather the answers, but the business signs them and owns them.
Why do cyber insurance claims get denied?
Two documented patterns stand out. In a 2022 US case, an application said MFA was in place across the company, and both sides agreed to void the policy. In Hamilton, Ontario, CBC reported the city's insurer would not cover part of its claims because MFA was missing in many departments. Read your policy's conditions and make every yes true.
Common questions
Will my form ask exactly these items?
Not word for word. Each insurer writes its own form, so read the exact wording on yours and answer that.
Where do I start?
With the item you're least sure about. Item 1 is a good default, because most forms ask about it.
Can I leave a question blank?
Ask your broker first.