Do you enforce multi-factor authentication (MFA)?
What insurers are looking for
Insurers usually ask about MFA in three places: email, remote access (VPN, remote desktop, cloud consoles) and administrator accounts. They want MFA turned on for every user in each place, not just some. A gap here is one of the most common reasons applications are declined or priced higher.
Do you keep offline or immutable backups, and have you tested a restore?
What insurers are looking for
Insurers want at least one backup copy that ransomware cannot reach or change: stored offline, or in storage that cannot be edited or deleted for a set period. They also ask whether you have actually restored from a backup recently, because an untested backup may not work when you need it.
Do you run endpoint protection or EDR on every device?
What insurers are looking for
Applications ask whether laptops, desktops and servers run endpoint detection and response (EDR) software that can spot and stop suspicious activity, not just traditional antivirus. Expect follow-up questions about coverage: is it on every device, and who watches the alerts?
How do you handle patching and vulnerability management?
What insurers are looking for
Insurers want to know that operating systems and software are updated on a regular schedule, that critical security fixes are applied quickly, and that unsupported systems are retired. Some applications ask for your typical time to apply a critical patch.
Do you have a written incident response plan?
What insurers are looking for
Insurers want a written plan that says who does what when something goes wrong: who to call, how to contain the problem, how to notify the insurer and affected people, and how to recover. A plan that exists only in someone's head usually does not count.
How Scarlet Risk helps
Scarlet Risk's incident response plan generator drafts a written plan tailored to your business that you can review and adopt.
Do employees receive security and phishing training?
What insurers are looking for
Applications ask whether staff receive security awareness training, how often, and whether you run phishing simulations. Insurers like to see records: who was trained and when.
How Scarlet Risk helps
The AI Phishing Simulator sends a realistic phishing campaign to your team and produces a per-employee click report. The in-app security awareness quiz gives you a training record.
How do you control privileged access and offboard departing employees?
What insurers are looking for
Insurers want admin rights limited to the people who need them, separate admin accounts from everyday accounts, and access removed promptly when someone leaves. They may ask how quickly accounts are disabled after a departure.
How Scarlet Risk helps
The Employee Offboarding Sweeper checks a departing employee against your connected apps and produces a signed-off offboarding record.
How do you manage vendor and third-party risk?
What insurers are looking for
Insurers ask whether you know which vendors hold your data or can access your systems, whether you review their security before signing, and whether contracts cover security responsibilities.
How Scarlet Risk helps
Scarlet Risk's vendor risk assessment helps you assess and record vendors, and the risk register keeps vendor risks alongside your other risks.
Do you have written security policies?
What insurers are looking for
Insurers want written, approved policies covering topics such as acceptable use, passwords and access, data handling, backups and incident response. They are looking for policies you actually follow, not just documents on file.
How Scarlet Risk helps
The GRC policy generator drafts a policy library tailored to your business for you to review, adjust and approve.
Cyber insurance readiness FAQ
- What do cyber insurance applications ask small businesses?
- Most applications ask about MFA on email, remote access and admin accounts; offline or immutable backups and tested restores; endpoint protection or EDR; patching; a written incident response plan; employee security and phishing training; privileged access and offboarding; vendor risk; and written security policies.
- Can Scarlet Risk guarantee I will get cyber insurance?
- No. Scarlet Risk helps you understand your gaps and prepare documentation. Insurers make their own underwriting decisions, and Scarlet Risk does not provide insurance or legal advice.
- Which Scarlet Risk features help with an insurance application?
- The incident response plan generator, GRC policy generator, AI Phishing Simulator, Employee Offboarding Sweeper, vendor risk assessment and risk register help with the related questions. Scarlet Risk does not provide MFA, backups, EDR or patching tools.
- Is Scarlet Risk an audit or certification for insurers?
- No. Scarlet Risk is not a certification, audit, or penetration test, and it does not replace an auditor or a qualified security professional.
Scarlet Risk is not a certification, audit, or penetration test, and this page is not insurance or legal advice. Your insurer's application and your broker are the authority on what your policy requires.
How we score and where AI is used: Methodology & limitations.