The Ten-Day Answer Services vCISO Advisory Leadership Baseline Cyber Insurance Readiness HIPAA Risk Assessment Risk Assessment MSP Security Oversight Industries Healthcare Financial Services Manufacturing & Logistics Legal & Professional Construction Defense Suppliers Locations Tacoma & Pierce County Spokane & Eastern WA Coeur d'Alene & North Idaho Resources Free Insurance Readiness Checker Cyber Insurance Application Guide Security Questionnaire Guide What a vCISO Costs vCISO vs MSP WA My Health My Data Act FTC Safeguards Rule Blog For MSPs & MSSPs About Community Contact Get a Ten-Day Answer
Get a Ten-Day Answer Call
Home › Free Tools › Cyber Insurance Readiness Checker

Will your cyber insurance answers hold up?

Twelve questions on the controls cyber applications commonly ask about. Three minutes. You get an honest read on which answers are solid, which need documentation, and which to fix before you sign. Your answers stay in your browser.

1. Is MFA required on every email account, including admin and shared mailboxes?

Email compromise is one of the most common ways attackers get in, so nearly every application asks.

2. Is MFA required for all remote access: VPN, remote desktop, and remote support tools?

Remote access without MFA is a common route for ransomware.

3. Is MFA required on every administrator and privileged account, including your IT provider's?

Applications increasingly ask about privileged accounts separately from email.

4. Is endpoint detection and response (EDR), not just antivirus, on every computer and server?

Carriers distinguish EDR from traditional antivirus, and "every" includes servers.

5. Are backups kept offline, immutable, or under separate credentials that ransomware cannot reach?

Backups that share credentials with production are often encrypted along with it.

6. Have you tested a full restore in the last 12 months, and written down the result?

An untested backup is a guess; many applications ask about testing specifically.

7. Are critical patches applied within a defined window, with no unsupported operating systems in use?

End-of-life systems are a frequent exclusion or decline reason.

8. Do administrators use separate admin accounts, not their everyday email account?

Daily-use accounts with admin rights turn one phishing click into a full compromise.

9. Do employees get phishing and security awareness training at least once a year?

Applications commonly ask about training frequency and phishing simulation.

10. Do you have a written incident response plan that was tested or reviewed in the last 12 months?

Carriers want to know you will call them, and the right people, quickly.

11. Do you verify every new or changed payment instruction by phone, using a number already on file?

Funds transfer fraud is common and often has its own section or sublimit.

12. Is third-party and vendor remote access limited, protected with MFA, and logged?

Vendor access is a growing focus because it bypasses your own controls.

How the score works

Each answer is scored on whether it would hold up if a carrier asked for proof. "Yes, and we can prove it" scores fully. "Yes, but nothing written down" and "Partly" score half, because an undocumented yes on a signed application is a risk, not a strength. "No" scores zero. "Not sure" also scores zero and is flagged separately: answering yes to something you are not sure about is the most dangerous answer on the form.

The checker is a starting point, not an underwriting decision. Carriers weigh controls differently, and we make no promise about premiums or approval. For the full walkthrough of each control, read cyber insurance application questions, answered, or see how cyber insurance readiness works.

Frequently Asked Questions

About the checker.

No. Every carrier words its questions differently. The checker covers controls that cyber applications commonly ask about, so you know where you stand before the real form arrives.

Because the application is a signed statement. If a claim is investigated, an answer you cannot back up with evidence is close to a no. Documenting what you already do is often the fastest improvement available.

No. Your individual answers never leave your browser. We count anonymous usage, such as that someone finished the checker and their overall score, to improve the tool. If you later contact us, that visit history is linked to the email you give us; your checker answers are not part of it.

Start with anything marked "fix before you sign." Bring the list to your IT provider and your broker early. If the application is already on your desk, the Ten-Day Answer gets it answered accurately in ten business days.

Something security-related landed on your desk?

Send it to us. One questionnaire, insurance application, or contract exhibit, answered in ten business days for a fixed $3,500.

Get Your Ten-Day Answer or book a free 30-minute call