Getting ready for your cyber insurance renewal

When someone signs in to work email, does it also ask for a code or an approval on their phone?

That second step is what people mean by multi-factor sign-in.

Have on hand A screenshot of the email sign-in setting, or a list of who has it turned on.

If anyone connects to the office from home or on the road, does that sign-in ask for a code or an approval too?

Think of remote desktop, or any link that reaches office computers from outside. If nobody does that, answer yes and have a note saying so.

Have on hand A screenshot of the remote sign-in setting. If nobody connects from outside, a line saying so.

Do the accounts that can change settings or pay bills ask for a code or an approval too?

Think of whoever manages email and computers, the online bank login and anyone who approves payments.

Have on hand A list of those accounts, with a screenshot showing the second step is on for each.

Does every computer have security software that spots and stops ransomware?

Every computer means every one, the owner's laptop and the one at the front desk included.

Have on hand A security report that lists every computer, with real dates.

Are security updates put on every computer on a schedule, with a report that shows it happened?

Windows and Mac both nag about updates. This is about someone making sure they get done.

Have on hand A report showing which computers were updated and on what dates.

Can only a few people install software or change settings on the office computers?

If everyone can install what they like, the answer is no.

Have on hand A list of who can install software or change settings on each computer.

Does your email have security that screens out phishing and fake invoices before they reach people?

This is more than the spam folder.

Have on hand A screenshot or report from the email security setting showing it is on.

Do your staff practice spotting scam emails and texts, at least once a year?

A short quiz or a talk at a staff meeting works, as long as you can show it happened.

Have on hand The date, and a list of who took part, such as quiz results.

When someone leaves, are their accounts turned off the same day?

Email, the shared folders, the bank login, anything they could still sign in to.

Have on hand The last few people who left, with the date each left and the date each sign-in was turned off.

Is there a cloud backup of every computer, kept somewhere other than your office network?

This is the copy that lives away from the computer.

Have on hand A report or screenshot showing a cloud backup of every computer, with the date of the last one.

Are your backups checked daily for failures, with someone told when one fails?

A copy that quietly stops working is easy to miss.

Have on hand A report from your daily backup checks, with dates.

Is there a written plan, with phone numbers, for the day your systems stop working?

Who to call, in what order, and who tells staff and customers.

Have on hand The plan itself, printed, kept where you can reach it without the office network.