What security controls do cyber insurers usually require?

A short list comes up in most application forms, although each insurer sets its own. Expect questions about multi-factor authentication (MFA) for e-mail, remote access and administrator accounts; backups kept offline or immutable and tested by a restore; timely patching, especially of systems reachable from the internet; endpoint detection and response (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) on laptops and servers; e-mail filtering and staff awareness training; restricted administrator rights; an incident response plan; and some form of monitoring with a named person who responds. Answer for the whole company, not the best-run part, and write down the evidence behind each “yes”. The form is part of the contract, so a wrong answer weighs more than a missing control you disclosed. NetSenX covers part of the monitoring question: on every plan, Free included, it detects beaconing to command-and-control servers, scanning, lateral movement and unusual outbound data volume on the segments it watches. It is not MFA, EDR or a backup, and does not replace them.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Cyber insuranceAll topics