The cyber insurance questionnaire, control by control

Every cyber insurance renewal comes with an application, and for a company of 10 to 50 people it usually lands on whoever handles IT. The wording changes from carrier to carrier, but the same controls come up on nearly every form: multi-factor authentication, endpoint detection and response, backups, phishing training, patching, remote access, payment verification and an incident plan.

Below, each control has the questions as they usually appear, what has to be in place before you can answer yes, and the least expensive way to get there. Prices come from each vendor's own page on October 25, 2026 and are worked out for a 10-person office. This guide is documentation-based: none of the products were run hands-on for it.

A "yes" is a statement the carrier relies on

In 2022 Travelers asked a federal court in Illinois to rescind a cyber policy it had sold to International Control Services. The application said multi-factor authentication protected administrative and remote access. After a ransomware attack, Travelers found that MFA protected the firewall and nothing else. ICS agreed to a judgment rescinding the policy, which left it with no coverage for the attack (Lockton's summary of the case).

So answer the question the form asks, at the scope it asks it. "Do you enforce MFA for all remote access?" covers the VPN, remote desktop tools and webmail, not only the one system that happens to have it. If the true answer is "partly", say so and attach a note. A partial answer may cost you on premium. A false yes can void the policy, as it did for ICS.

Multi-factor authentication

Typical questions:

• Do you require MFA for all users to access email, including webmail and mobile?
• Do you require MFA for all remote access to the network?
• Do you require MFA for administrator and privileged accounts, including the backup console?

Email is the first one, and it costs nothing. On Microsoft 365, turning on security defaults in Microsoft Entra ID makes every user register for MFA and blocks the legacy sign-in protocols that skip it. It is free in every tenant, but it is off unless someone turned it on. Security defaults prompt ordinary users when Microsoft judges the sign-in risky rather than every time. If your carrier wants MFA at every sign-in, that takes a Conditional Access policy, which needs Entra ID P1 (included in Microsoft 365 Business Premium). On Google Workspace, 2-Step Verification enforcement is in every edition.

Remote access means anything that reaches the office network or its files from outside: a VPN, a remote desktop tool, a file server published to the internet. Each needs its own MFA, or it needs to sit behind sign-in that already has it.

The administrator question is where small offices most often answer wrong. Your Microsoft 365 global admin, the firewall login, the backup console, the domain registrar and the password manager's admin account all count. Use a separate admin account for each person who needs one, put MFA on it, and stop using it for daily email.

Where a password manager fits

A password manager does not put MFA on your email; Microsoft or Google does that. What it does is hold the logins for everything else, enforce MFA on the vault itself, and give you a report of who has it switched on. Many applications also ask directly whether you use one.

Keeper's Business Starter plan is $2 per user per month billed annually, for teams of 5 to 10 users, which is $240 a year for 10 people. Business, at $4 per user per month, adds shared team folders and delegated administration. Keeper's admin console can require two-factor authentication for everyone in a role.

Screenshot: Keeper documentation.

1Password's Teams Starter Pack is $24.95 a month billed annually ($299.40 a year) for up to 10 people, with up to 10 more seats at $4.99 each. 1Password Business is $8.99 per user per month. In Business, an owner or administrator can enforce two-factor authentication from the Authentication policy, after setting the account password policy to Strict.

Endpoint detection and response

Typical questions:

• Do you use an endpoint detection and response (EDR) tool on all endpoints and servers? Which product?
• Is it monitored, and by whom?

Traditional antivirus matches known malware. EDR also records what processes do on the machine, and can isolate the machine or undo changes when something behaves like an attack. Name the product you actually run, and expect a follow-up question on "monitored".

If the office already pays for Microsoft 365, Microsoft Defender for Business is the cheapest way to a true yes: $3 per user per month billed yearly, covering up to five devices per user, with EDR and automatic attack disruption included. That is $360 a year for 10 people. It is also included in Microsoft 365 Business Premium. Servers need a separate add-on.

Bitdefender is the other common answer for small offices, and its plan names need care. On Bitdefender's own comparison page, 10 devices for one year cost $269.49 for GravityZone Business Security and $615.99 for Business Security Premium (both shown at 30% off). Bitdefender describes Premium as prevention "without additional detection and response capabilities". The tier it sells as EDR is GravityZone Business Security Enterprise, which is quote-only. Premium includes ransomware mitigation and fileless attack protection (shown below). If your form asks "Do you have EDR?", read Bitdefender's description before you tick yes on Premium alone, or ask your broker whether Premium counts.

Screenshot: Bitdefender.

For "monitored", a one-person IT department can answer that alerts go to a named person by email and are reviewed every business day, provided that is true. If the form asks for 24/7 monitoring, that is a managed detection and response (MDR) service, which costs more than any tool on this page.

Backups

Typical questions:

• Do you back up critical data at least weekly?
• Are backups kept offline, or in a cloud service separate from your network, so that ransomware on the network cannot reach them?
• Are backups encrypted, and is access protected by separate credentials and MFA?
• Have you tested a restore in the last 12 months?

The second question is the one that matters. Ransomware encrypts a copy on a NAS that every workstation can write to along with everything else. A cloud backup with its own login, protected by MFA, is the minimum that answers yes. Some forms ask for the date of the last restore test, so keep it.

Backblaze Business Backup is $99 a year per computer, so $990 a year for 10 laptops. It includes one year of version history, enough to roll back past a ransomware infection found weeks later. The admin console can restore files on a user's behalf in a managed group, and backup lock-down controls prevent unauthorized changes to settings. It covers computers and their attached drives, not servers or NAS boxes.

IDrive Team covers 10 computers and 10 users with 10 TB for $13.99 a month billed yearly, which is $167.88 for the first year; IDrive's page says standard pricing applies from the second year. If you also need a server or NAS backed up, that is IDrive Business, which starts at $13.99 a month for 500 GB on the same first-year terms.

Whichever you choose, put MFA on the backup console, run a restore of one real folder, and write down the date. That note is your answer to the restore-test question.

Phishing training and simulation

Typical questions:

• Do all employees complete security awareness training at least annually?
• Do you run simulated phishing campaigns? How often?

Annual training alone can be met with free material and a sign-in sheet. Simulated phishing needs a tool that sends the test emails and reports who clicked.

CyberHoot sells to small businesses directly as well as through MSPs. Its phishing exercises show staff a sample email and ask them to judge the sender and the links, as below. CyberHoot sends its pricing by email rather than publishing it, so there is no figure to quote here.

Image: CyberHoot.

Whatever tool you use, keep the completion report. "Training completed by 12 of 12 staff, last phishing test September 3" is what an underwriter wants to see if they ask.

Patching and unsupported software

Typical questions:

• Are critical patches applied within 30 days (some forms say 14, or 7 for internet-facing systems)?
• Do you run any software or operating systems that no longer receive security updates?

For workstations, automatic Windows and macOS updates plus a monthly check that every machine is current is enough to answer the first question for most offices. The weak spots are the firewall, the NAS and line-of-business apps, which do not update themselves. Put them on a calendar.

The second question has caught many offices out since Windows 10 reached end of support on October 14, 2025. A Windows 10 PC without Microsoft's paid Extended Security Updates is unsupported software, and the correct answer is yes. Upgrade it, enroll it in Extended Security Updates, or list it on the form with a replacement date.

Remote access and exposed services

Typical questions:

• Is Remote Desktop Protocol (RDP) accessible from the internet?
• Do you use a VPN or other secure gateway for remote access, with MFA?

The right answer to the first is no, because RDP open to the internet is a common way in for ransomware. Check the firewall's port forwarding rules for 3389 or any rule pointing at an internal PC. Then answer the second: if staff connect through a VPN, it needs MFA; if they use a remote desktop product, its account needs MFA.

A business VPN or zero trust access comparison is coming in a later guide. For a small office, a VPN on the existing firewall with MFA turned on usually costs nothing extra.

Payments and funds transfer fraud

Typical questions:

• Do you verify any request to change bank details or send a wire transfer by calling the requester on a known number?
• Do two people approve payments above a set amount?

This control costs nothing, and some policies make social engineering cover conditional on it. Write a one-paragraph procedure: any change to payment details, or any new payee, is confirmed by phone using a number already on file (never one from the email), and payments over a set amount need a second approver. Have the people who pay bills sign it.

Incident response plan

Typical questions:

• Do you have a written incident response plan?
• Has it been tested or reviewed in the last 12 months?

A small office plan can fit on two pages: who decides, who calls the insurer, which outside firm restores systems, where the backups and admin credentials are, and how staff are told. Put your carrier's breach hotline number on the first page. Many policies expect you to call it, and to use the carrier's approved firms, before you hire anyone. CISA's incident response plan basics is a free starting point. Review it once a year at renewal, and note the date.

Cost for a 10-person office

Before training, the paid lines come to $768 to $1,649 a year for a 10-person office, depending on which password manager and backup you choose.