CYBER SECURITY
INSURANCE READINESS

  Cyber Insurance Scorecard

Our team will step you through a non-technical assessment to create an initial snapshot of your company's security posture and potential insurability. 

Our simplified questionnaire is based on the top questions you'll encounter from most insurance carriers, providing you with an easily understandable view of your company's security and policy foundations and where to focus improvement efforts.

Explore the list on the right of the key questions we ask on our Cyber Insurance Scorecard.

• Authentication

  Multi-factor authentication has long been a requirement for most insurance policies. Now, insurers are requiring deeper use of MFA to secure remote access, admin accounts, and more.

  • Do you require MFA for Identity / Login?
  • Do you require MFA For Remote Network Access?
  • Do you require MFA for Admin Access?
  • Do you require MFA for Remote Email Access?
  • Do you use a Password Manager for End Users and does it require MFA?

• Infrastructure

  Many clients have basic security infrastructure in place, but often lack proper visibility and reporting to meet insurance requirements. We dig into the details:

  • Do you have an active firewall in use?
  • Do you have managed EDR/MDR Endpoint Protection on all devices?
  • Do you have an inventory of all devices, applications, and where your data resides? 
  • Do you enable data encryption for aervers, laptops, and mobile devices?
  • Do you have proper data backup, are those backups encrypted, are they tested, and is your data backup solution protected by MFA?

• Security Operations

  Business of all sizes are being asked to take key steps to update systems, log security events, and engage with a security team to manage incidents. We explore these key points:

  • Do you have automated patching and updating of workstations, servers, and network devices?
  • Do you have a Security Incident Response Plan?
  • Do you perform Security Event Logging?
  • Do you have an HR process for adding / removing users?
  • Do you utilize a Security Operations Center (SOC)?

• Assessments & Education

  Security assessments and employee training are key to a establishing a strong security culture. We pinpoint the following key aspects:

  • Do you conduct annual security awareness training?
  • Do you perform email phish testing?
  • Do you have a 3rd-party conduct an annual network security assessment?
  • Do you have a 3rd-party conduct an annual penetration test?
  • Do you log the improvements on your security gaps?

• Data

  One of your most important assets is your company's data. Our scorecard helps to identify where your data is located, the classification of your data, and the protections needed to properly secure and backup your information.

  • Do you handle sensitive data?
    • PCI - Credit Card Data
    • HIPAA - PHI, PII Data
    • Financial Data
  • How many records do you store?
  • Is your data encrypted at all stages?
    • At Test
    • During Transmission
    • Mobile or BYOD Access
    • Data Accessed by a 3rd Party
  • Do you have Data Loss Prevention in use?
  • Is your data access restricted by role?

• Policies

  Technology is only one piece of the puzzle. A successful security strategy must include the policies to govern and guide employees and leadership to insure proper workflow is followed.

  • Privacy Policy
  • Acceptable Use Policy
  • Password Policy
  • Mobile Device Policy
  • Remote Access Policy
  • Incident Response Policy
  • Wire Transfer Policy
  • Data Retention
  • IT Asset Disposal Policy
  • 3rd Party Access Policy

• Business Operations

  Rounding out our scorecard, we explore key aspects of your business operations to set the proper security posture:

  • Do you have a CISO or Privacy Officer?
  • Do you have a Business Continuity Plan, and do you test it annually?
  • Do you outsource your business platforms and do you have alternatives available to avoid a business interruption?
  • Do you have a vendor access policy, do you log access, do you regularly review rights, and do you have a removal procedure?
  • Have you experienced a breach or system failure in past 3 years?
  • Have you been denied cyber insurance coverage in the past 3 years?