Multifactor authentication
Identify which accounts and access paths require MFA, including administrators, email, remote access, and separate applications. Check enforcement and exceptions, not just whether staff enrolled a phone.
Turn each question into a verification task.
Start with the current questionnaire and the systems it covers. Copy the exact question into a working record, identify who can verify it, and note what evidence supports the answer. Words such as “all,” “enforced,” and “tested” deserve a closer look.
Keep technical verification separate from interpreting policy wording. Your broker or insurer should clarify ambiguous questions and coverage requirements. BCIT can help review technical controls and configuration within the agreed scope; the business approves its submission.
This cyber insurance IT checklist is a preparation tool. It is not a universal list of insurer requirements or a guarantee of coverage. Different forms ask different questions, so work from the form in front of you.
What to verify in the actual environment
Device protection
Compare the device inventory with active protection and monitoring. Include laptops that seldom connect, servers, and other supported endpoints in scope. Record missing or unhealthy devices.
Backup and recovery
List protected systems, storage locations, retention, access controls, and recent restore checks. Separate a successful backup job from evidence that the required data or system can be recovered.
Updates and unsupported systems
Identify who tracks updates, handles failures, and approves exceptions. Record systems that cannot be updated normally, their constraints, and the action plan.
Account lifecycle
Review administrator access, former employees, shared credentials, and remote support access. Name the person responsible for joiners, changes, and departures.
Incident response
Confirm who receives alerts, who investigates, who can authorize containment, and how the business reaches the right people during an incident. A contact list needs current names and responsibilities.
Keep a short evidence record.
For each answer, record the system or group checked, verification date, responsible person, supporting evidence, and known exceptions. Use screenshots or reports where appropriate, but keep sensitive configuration and account information in a restricted location.
For example, an MFA record could identify the applicable policy, covered account groups, exclusions, and the result of an approved verification check. That is more useful than a screenshot showing that one employee has an authentication app.
For recovery, record what was restored, where it was tested, whether the information was usable, and any unresolved problem. Do not present a file restore as evidence of a full business-system recovery if that was not tested.
CISA’s ransomware guidance recommends regular backup testing and protecting backups from the reach of ransomware. Use it as technical background, then compare the actual configuration and testing with the wording on your questionnaire.
Handle gaps honestly and assign the next action.
If an answer cannot be verified, mark it for follow-up rather than treating “probably” as a technical finding. A missing control, a documented exception, and an unknown state are three different things. Each needs an owner and a clear explanation.
Ask your broker or insurer how to describe a gap or planned improvement. Your IT provider can explain the technical state and the proposed work. Do not turn a planned change into a statement that it is already complete.
A useful review may produce a small list of priorities: enforce a policy for an uncovered group, restore a missing device to monitoring, run a representative recovery test, or document an escalation path. Verify the result after the work is done.
Use the renewal as a maintenance checkpoint.
Keep the final approved answers and their evidence together. When the business adds a location, changes software, replaces a backup system, or changes providers, review which answers may need a fresh check. Reusing last year’s form without checking the environment carries forward last year’s assumptions.
Our cybersecurity services, recovery planning, and managed IT work can support the technical responsibilities agreed with your business. A clear scope should identify what is managed, what is checked, and what remains with the business or another provider.
Common questions
Does having an IT provider mean we can answer yes to every control question?
No. Verify the specific systems, configuration, coverage, and exceptions the question asks about. A service agreement describes responsibilities; it does not by itself prove the current state of every control.
Can BCIT complete the insurance form for us?
BCIT can help verify technical information within the agreed scope and identify questions that need further clarification. Your business approves its answers, and your broker or insurer should interpret policy wording and coverage requirements.
Know which controls are actually in place.
Start with a free business conversation and initial onsite technology assessment with network discovery.
Request My Free AssessmentCall (269) 261-0269