Cyber insurance readiness checklist

Client ______________________________

Date ______________

Filled out by ______________________________

How to use this

Print this page. A broker can hand it to a client and mark each line yes, no, or not sure. The boxes are for a pen. This page does not save answers.

Answer from what is in place today. Coalition's form says that if a policy is issued, the application becomes part of the policy. The person who signs it is stating the answers are true. A yes you cannot support is a worse answer than a no.

We are the IT company. Your broker and the carrier decide the policy. We do not fill out the application. On our cybersecurity page we say the same thing: we help with the technical facts, and filling out the application is not part of the work. The person who signs it owns the answers.

Checking these lines does not mean a carrier will offer coverage, approve an application, or pay a claim. Each carrier writes its own questions, and forms change. Travelers says on its cyber readiness page that following a list of practices does not decide a claim. We are saying the same thing here. The form in front of you is the one that counts.

The eight controls below are the ones we see most often on public applications and in CISA, FTC, and NIST guidance for small offices: multi-factor authentication, endpoint detection and response, backups and an offline copy, patching, email security, administrator accounts, an incident response plan, and training.

1. Multi-factor authentication

Forms usually split this question. A public Coalition cyber application (form CYUSP-00NA-1022-01) asks whether multi-factor authentication is enforced for email, for VPN, for Remote Desktop or other remote access, and for network or cloud administration and other privileged accounts. A public Travelers CyberRisk application (form CYB-14102, revised June 2020) asks about multi-factor authentication for administrative or privileged access, for remote access to the network and to systems that hold sensitive data in bulk, and for remote access to email.

CISA's #StopRansomware Guide says to use phishing-resistant multi-factor authentication for services, in particular email, VPNs, and accounts that reach critical systems. CISA's small-business guidance says to require it with a technical control, and to put it on administrator accounts. Asking people to enroll when they have a minute leaves gaps.

Mark yes only if

• Email cannot be opened with a password alone, including webmail and the phone app.
• Remote access requires a second factor wherever you allow it. If the office has no VPN and no remote desktop, the fitting answer is often not applicable.
• Administrator and other privileged accounts require it, including Microsoft 365 or Google Workspace admin, the firewall, and the backup console.
• New people are enrolled before they get access, and you can list anyone who is exempt and why.

On a Novaj Tech managed plan, two-step sign-in on Microsoft 365 or Google Workspace is part of both plans. Remote desktop, the firewall, the backup console, and a leftover admin account are separate lines on the form.

Sources: CISA, #StopRansomware Guide; CISA, Cyber Guidance for Small Businesses; Coalition application CYUSP-00NA-1022-01; Travelers CYB-14102.

2. Endpoint detection and response

Travelers CYB-14102 asks whether up-to-date antivirus is active on all computers, networks, and mobile devices. That form does not use the words endpoint detection and response. Travelers' cyber readiness page does, and it lists endpoint detection and response as its own practice, separate from antivirus. CISA's #StopRansomware Guide says to use application allowlisting, endpoint detection and response, or both, on all assets, so only authorized software can run.

Mark yes only if

• You can name the product on the computers and on the servers.
• You can show which machines are missing it. A laptop in a drawer still counts if it can join the network.
• Someone is responsible for the alerts, and you can say who.
• If the form asks about servers or domain controllers, you checked those, along with the laptops.

On our managed plans, managed detection and response by Huntress is included. Huntress reviews anything odd on computers and logins and can cut off an infected computer. If the form says EDR, write Huntress and which machines it is on. Use the product name you can point to.

Sources: CISA, #StopRansomware Guide; Travelers CYB-14102; Travelers, cyber readiness practices.

3. Backups and an offline copy

Coalition's application asks whether you keep at least weekly backups of sensitive or critical data, and of critical business systems, offline or on a separate network. Travelers CYB-14102 asks whether backup and recovery procedures cover important business and customer data, whether they run on their own, and whether they are tested at least once a year. That Travelers form does not ask the word offline. Travelers' cyber readiness page says to keep at least one backup off-site and offline.

CISA's #StopRansomware Guide says to keep offline, encrypted backups of critical data and to test that you can restore them. The guide says many ransomware variants try to find backups they can reach, then delete or encrypt them. CISA's small-business backup page calls this the 3-2-1 rule: three copies, two kinds of storage, and one copy off-site, plus offline copies and a restore test.

Mark yes only if

• You can name what is critical for this office: email, shared files, and the system the office cannot work without.
• At least one copy is offline, or on a separate network, so the daily admin login cannot wipe it.
• The copies are encrypted.
• Someone has restored a real file or a mailbox and written down the date. A job report that says success is a backup log. A restore is a separate test.
• You know how far back the copies go, and whether that matches the weekly or annual question on your form.

Cloud backup of email and files, with scheduled restore tests, is on our Complete plan. Read the question on the form before you answer the offline line. The day-to-day of how we watch backups is on the backup page.

Sources: CISA, #StopRansomware Guide; CISA, Back Up Business Data; Coalition application CYUSP-00NA-1022-01; Travelers CYB-14102; Travelers, cyber readiness practices.

4. Patching

Travelers CYB-14102 asks whether you regularly download, test, and install patches, whether that process is automated, and whether critical patches are installed within 30 days of release. CISA's #StopRansomware Guide says to patch software and operating systems, and to put internet-facing systems and known exploited vulnerabilities first. CISA publishes that list as the Known Exploited Vulnerabilities catalog. NIST's small-business basics say to update and patch software when a new version is available.

Mark yes only if

• Computers and servers install updates without waiting on someone to click later.
• You can say what happens to a critical update, including whether 30 days is true here.
• The firewall, the network gear, and the line-of-business software are on the list, along with Windows or macOS.
• Anything you cannot patch is written down, with the reason.

Patching is part of a Novaj Tech managed plan. The form still wants the cadence and the exceptions.

Sources: CISA, #StopRansomware Guide; CISA, Known Exploited Vulnerabilities catalog; NIST, Cybersecurity Basics; Travelers CYB-14102.

5. Email security

Multi-factor authentication on the mailbox is its own line, in the first section. Filtering and spoofing controls are this one. CISA's #StopRansomware Guide says to filter at the mail gateway, to mark messages that come from outside the organization, and to filter attachment types that commonly carry malware. The same guide says to publish DMARC, which builds on SPF and DKIM, so other mail servers can reject fake mail that pretends to come from your domain. DMARC on your domain does not, by itself, stop spoofed mail from someone else's domain. NIST's phishing note says to use the filters and authentication options your mail host provides.

Mark yes only if

• Inbound mail is filtered before it reaches the inbox, and you can name the product.
• Mail from outside the company is marked, if your form asks about that.
• Your domain has SPF and DKIM, and a DMARC record someone has opened and read. A guess that the host turned it on is a not sure.
• The mailbox multi-factor line is answered in section 1. Count it there.

Email filtering that catches scam and fake mail is on our Complete plan, along with staff training that uses practice scam emails. Mailbox multi-factor authentication is on both plans, as described above. How we run Microsoft 365 and Google Workspace is on the Microsoft 365 page.

Sources: CISA, #StopRansomware Guide; NIST, Phishing.

6. Administrator accounts

CISA's #StopRansomware Guide says to keep administrator accounts separate from ordinary user accounts, and to keep root or global admin accounts off daily work. CISA's small-business guidance says to take administrator rights off user laptops, because a person who can install anything can install an attacker's program. Travelers CYB-14102 asks whether access is removed when someone leaves. Coalition asks about multi-factor authentication on network and cloud administration and other privileged accounts.

Mark yes only if

• Daily mail and browsing happen on a normal account. Admin work happens on a different account.
• You can name who has global admin, domain admin, or the equivalent. The list is short.
• Those admin accounts use multi-factor authentication.
• People who have left have no mailbox, no VPN login, and no admin role. The exit is a written step, and someone follows it.
• Shared logins such as a single office@ or admin@ mailbox are gone, or they are tied to a named person.

A shared password vault is on our Complete plan. It is one place to keep admin passwords off a sticky note. The form still wants the account list.

Sources: CISA, #StopRansomware Guide; CISA, Cyber Guidance for Small Businesses; Coalition application CYUSP-00NA-1022-01; Travelers CYB-14102.

7. Incident response plan

Travelers CYB-14102 asks whether you have an incident response plan for a network intrusion, and whether the plans you listed are tested and the gaps fixed. CISA's #StopRansomware Guide says to keep a basic cyber incident response plan and a communications plan, to practice them, and to keep a paper copy, because the network may be the thing that is down. NIST's Small Business Quick-Start Guide (SP 1300) says to know who is in charge, who to call, and how you will tell the people a law or a contract requires. The call list in that guide includes the insurer. The FTC's small-business guidance says to have a plan for saving data, keeping the business running, and notifying customers.

Mark yes only if

• The plan is written down. A plan that lives in one person's memory is a no.
• It names who decides, who calls the insurer and the broker, and how you reach them if email is down. The phone numbers are on paper.
• It says who you notify. A lawyer or the carrier may need to go first. We do not write notice letters.
• Someone has walked through it, even as a tabletop, and the date is written down.
• It says where the backups are and who is allowed to restore them.

Sources: CISA, #StopRansomware Guide; NIST SP 1300, Small Business Quick-Start Guide; FTC, Cybersecurity for Small Business; Travelers CYB-14102.

8. Training

Travelers CYB-14102 asks whether employees get privacy and information security training every year. CISA's #StopRansomware Guide calls for a user awareness program that includes how to spot and report phishing, and it says to repeat that training. The FTC says to train staff on a regular schedule, including what to do if a laptop or files are lost. NIST's small-business basics say to train people on ordinary cybersecurity habits.

Mark yes only if

• Training has a date. A poster on the wall is not a date.
• You can say who finished it and who has not.
• It covers phishing, and how to report a suspicious message to a person.
• New hires get it on the schedule your form asks about. The Travelers question is annual. Use the interval printed on your form.

Practice scam emails are part of staff training on our Complete plan. If the form asks whether you send practice phishing mail, answer from whether you actually send it.

Sources: CISA, #StopRansomware Guide; FTC, Cybersecurity for Small Business; NIST, Cybersecurity Basics; Travelers CYB-14102.

Before you send it back

Read every yes again. If the evidence is a settings page, a device list, or a restore log, keep it with the application. If the evidence is "our IT person said so," write not sure and ask.

If you want a second set of eyes before the broker's call, book a free virtual call. On-site visits are paid. We will say which lines we can support from what is actually in place, and which lines should stay blank.

Where we do this

Westchester, New York City, and New Jersey, for offices of 5 to 50 people. We work from Pelham. The area pages are Westchester, New York City, and New Jersey. The same work sits on our cybersecurity, backup, and managed IT pages. Other notes are managed IT or hourly support and UniFi vs Cisco Meraki, both on the guides page.

Sources

We used public insurer forms and government guidance. We did not invent figures. Form numbers and revision dates are the ones printed on the PDFs we linked. A carrier can issue a newer form than the one on this page.

• CISA, #StopRansomware Guide
• CISA, Cyber Guidance for Small Businesses
• CISA, Back Up Business Data
• CISA, Known Exploited Vulnerabilities catalog
• FTC, Cybersecurity for Small Business
• NIST, Cybersecurity Basics
• NIST, Phishing
• NIST SP 1300, Cybersecurity Framework 2.0 Small Business Quick-Start Guide
• Coalition Cyber Policy Application, form CYUSP-00NA-1022-01 (public PDF)
• Travelers CyberRisk Application, form CYB-14102 Rev. 06-20 (public PDF)
• Travelers, 5 Cyber Readiness Practices