Guides

Step-by-step guides for the security questions on cyber insurance forms, written for a business without an IT team.

• How do I set up DMARC for Google Workspace?

  DMARC is a TXT record named _dmarc in your domain's DNS settings, not a switch in the Google Admin console. Set up SPF and DKIM first, then add a DMARC record with p=none and an inbox you read. Once your real email keeps arriving normally, change it to p=quarantine and keep a dated check result.

• How do I set up DMARC for Microsoft 365?

  For your own domain, Microsoft 365 has no DMARC switch: you add a TXT record named _dmarc wherever your domain's DNS lives. Set up SPF, turn on DKIM signing for your domain in the Defender portal, then add DMARC with p=none. Once your real email arrives normally, change it to p=quarantine and keep a dated check result.

• How do I turn on MFA in Google Workspace?

  In the Google Admin console, open Security, then Authentication, then 2-Step Verification. Pick your top organizational unit, allow it, and set enforcement to start on a date about a week away so staff can enrol. After that date, confirm every admin is enrolled and take a dated screenshot of the setting and the user list.

• How do I turn on MFA in Microsoft 365?

  Turn on security defaults in the Microsoft Entra admin center, under Entra ID, Overview, Properties. Microsoft then has every user register for two-step sign-in, usually with the Authenticator app, and requires it for admins. Staff are asked at their next sign-in. Keep a dated screenshot of security defaults showing Enabled, plus the list of who has registered.