Is Multi-Factor Authentication (MFA) required for:
Insurers treat MFA as table stakes. Any gap on this list is the question that gets asked first, and rejected on first.
Are critical security patches applied within 30 days for:
Most denied cyber claims involve a vulnerability that had a patch available more than 30 days before the breach.
Are critical backups kept offline or segregated from production:
If ransomware can reach your backups, you don't have backups. Insurers want to see at least one isolated copy.
Are your backups encrypted, MFA-protected and tested:
Encryption protects data at rest; MFA stops an attacker with admin creds from wiping recovery; a test proves the restore actually works.
Are payee and banking changes verified out-of-band for:
Catches the most common forms of invoice and CEO fraud, bad actor emails 'updated bank details' and gets paid.
Is dual-authorisation required for:
Two-person rule on sensitive money moves. Required by most policies that cover funds-transfer fraud.
Is security awareness training in place for:
Quarterly micro-training plus simulated phishing is the gold standard. Insurers increasingly ask which platform you use.