Cyber insurance IT requirements, met and documented.
Insurers now want proof of MFA, endpoint detection and response, tested backups and user training before they write or renew a policy. We put those controls in place for New Jersey businesses, keep the evidence, and sit with you to fill in the questionnaire.
What the application asks, and how we answer it.
Multi-factor authentication on email, remote access and admin accounts
MFA on every Microsoft 365 account with conditional access, so it is enforced rather than optional, and on VPN, remote desktop and the firewall. This is the first question on every form and the most common reason a claim is denied.
Endpoint detection and response on every device
SentinelOne on every workstation and server through Guardz, which is what carriers now mean when they say antivirus. Agents report in, and a device that drops off is a ticket.
Backups that are offsite, protected and tested
Servers and Microsoft 365 backed up to a separate location with copies that ransomware cannot encrypt, and a restore test on a schedule with the date recorded. See backup and disaster recovery.
Security awareness and phishing training
Short monthly training and simulated phishing through Guardz, with completion reports you can attach to the application.
Patching, email protection and privileged access
Patching on a schedule with reports from SuperOps, Microsoft 365 mail protection configured properly, no shared admin accounts, and local admin rights removed from day-to-day users.
A written incident response plan
One page that says who to call, what gets isolated, where the backups are and how the carrier is notified. Insurers ask whether you have one; after an incident, you will be glad you do.
The questionnaire, done with you.
Applications have become long and technical, and a wrong answer is worse than a weak one. We go through the form line by line with you, answer the technical questions from what is actually in place, and produce the evidence: MFA enforcement reports, endpoint coverage, backup logs, training completion. You attach it and move on.
If something happens anyway.
The first hours of an incident decide the cost. We isolate the affected machines, preserve what the carrier's forensics team will need, start the restore from clean backups, and work with the breach counsel the policy provides. Being able to show the controls were in place and working is what keeps the claim from being contested.
Questions we get
Will this guarantee our cyber insurance application is approved?
No. Underwriting is the insurer's decision. What we do is put in place the controls every current application asks about, keep the evidence, and fill in the questionnaire with you so the answers are accurate. Accurate answers also matter after a claim, when the carrier checks that what you attested to was actually in place.
Do we need to buy a separate security product?
If you are on a managed plan, no. SentinelOne endpoint detection and response, MFA, Guardz posture monitoring, awareness training and tested backups are in the plan. If you are not a managed client, we can put the controls in as a project before your renewal.
How long does it take to get ready for a renewal?
For a company under 50 people with Microsoft 365, usually two to four weeks: MFA and conditional access first, endpoint agents on every device, backup verification, then training and the paperwork. Start six weeks before the renewal date and it is not a scramble.
What does it cost?
Included in a security-forward managed plan, which as a planning range runs $200 to $400 per person per month. As a standalone project it is quoted up front after a short assessment of what you have now.
Renewal coming up?
Send us the questionnaire. We will tell you what is already in place, what is not, and what it takes to close the gap.