How do I check the answer to a question on my cyber insurance form?

Howy the walrus holding a form and scratching his head

Don't guess. Check the setting yourself using the table below, or send the exact question to your IT provider in writing and ask for a dated screenshot. If the true answer is partly, fix the gap first or tell your broker exactly what's in place. Your answers need to be true when you sign.

Checking an answer means looking at the actual setting, not going from memory.

Where to check each setting yourself

You need an admin sign-in. If a word on the form is new to you, the glossary explains it.

If the question is about Where to look
MFA on Google Workspace email Admin console, Security, Authentication, 2-Step Verification. Then Directory, Users, with the enrolment column added. Full steps
MFA on Microsoft 365 email Entra admin center, Properties, Manage security defaults. Full steps
Updates Windows Update on each PC, or Software Update on each Mac. Full steps
Antivirus Windows Security, Virus & threat protection. Full steps
Encryption Device encryption or BitLocker on Windows, FileVault on a Mac. Full steps
Backups File History or Time Machine, for the drive and last backup date. Full steps
DMARC The free email check on HowyGuard. Full steps

Check every computer and every account the question covers, not just your own.

How to ask your IT provider

  1. Copy the exact question from the form, word for word.
  2. Send it in writing and ask for a yes or no, plus a dated screenshot of the setting.
  3. If they say "mostly" or "for most people", ask which accounts or computers are missing. That's your gap.
  4. File their answer in your proof folder.

If the true answer is "partly"

  1. Fix the gap now if you can, using the guide for that item, then answer yes.
  2. If your form offers "sometimes", "partly" or a box to describe it, use that.
  3. If it only offers yes or no, ask your broker how they want a partial answer shown.

Common questions

Can my IT provider fill in the form for me?

They can gather the answers. The business signs and owns them, so read each one carefully and check it's true.

A question doesn't apply to my business. What do I do?

Use an N/A box if there is one. If not, write a note or tell your broker, instead of picking yes or no.

Do old staff accounts count?

If they can still sign in, yes. Close them, and they're out of the question.

Sources

  1. Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizationscyber.gc.ca
  2. Google Workspace Admin Help: Deploy 2-Step Verificationsupport.google.com
  3. Microsoft Learn: Security defaults in Microsoft Entra IDlearn.microsoft.com