What do cyber insurers ask about ransomware protection?
Mostly whether you could recover without paying and how quickly an attack would be noticed. Typical questions cover backups (are they offline or immutable, separate from your normal administrator accounts, and when were they last restored as a test), multi-factor authentication on remote access and e-mail, how fast critical patches are applied, whether remote desktop is exposed to the internet, whether administrator rights are limited, whether endpoints run EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. and whether someone monitors and responds to alerts. Some insurers also ask whether you have a ransomware playbook and who decides about a ransom demand. Ransomware is usually preceded by days of preparation inside the network: the attacker calls home, scans and moves between machines. That window is what network detection can shorten. NetSenX alerts on those steps on every plan and shows them in plain language, but it does not block traffic or restore data; backups and a tested recovery plan remain the answer to the first question.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Why was our cyber insurance renewal declined or made more expensive?
- Do cyber insurers require round-the-clock security monitoring?
- Does automated alerting count as 24/7 monitoring for an insurer?
- Can our managed service provider run NetSenX so we can answer yes on 24/7 monitoring?
- What should a monitoring contract say if our insurer asks about a SOC or response times?
Terms used here
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.