Is multi-factor authentication mandatory for cyber insurance?
For most insurers today it is close to a condition, at least for e-mail, remote access and administrator accounts. Multi-factor authentication (MFA) adds a second step to a login, such as a code from an app or a hardware key, so a stolen password alone does not open the account. Questionnaires often ask where exactly MFA is enforced, and the detail matters: MFA on e-mail but not on the VPN, or on users but not on administrators, can turn a “yes” into a misstatement after an incident. List every way into your systems, enforce MFA on each, document the exceptions and tell your broker about them. A network sensor cannot check MFA, because login events live in your identity and VPN logs. NetSenX itself offers two-factor authentication on every plan, Free included, for access to the NetSenX account, and does not verify MFA in your other systems.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Do cyber insurers require endpoint detection and response on every device?
- What do cyber insurers ask about ransomware protection?
- Why was our cyber insurance renewal declined or made more expensive?
- Do cyber insurers require round-the-clock security monitoring?
- Does automated alerting count as 24/7 monitoring for an insurer?