Business insurance insights
MFA on a Cyber Application: Which Accounts Are Actually Protected?
Use an optional account inventory to record MFA settings, unresolved exceptions and the evidence behind your cyber insurance application answer.
For a cyber insurance application, PolicyBenchmark suggests checking MFA account by account with your IT team before describing its scope. CISA’s business guidance calls for MFA across email, file storage and remote access, with particular attention to administrator accounts and employees handling sensitive data. Use those categories to organize the check, then answer the insurer’s actual question with the configuration your team confirms.
Check the access covered by your answer
CISA describes MFA as using two or more ways to establish a user’s identity. Its guidance tells businesses to confirm that remote network access and privileged or administrative access require MFA, and to work with their IT team or provider on implementation. It also advises using phishing-resistant MFA and the strongest available method. Cybersecurity and Infrastructure Security Agency
For preparation, PolicyBenchmark suggests copying the application’s exact MFA question into your working notes. Ask the IT owner to identify which systems and account groups that wording covers. If the question uses a term your team finds ambiguous, take that wording to the insurer for clarification before completing the answer.
PolicyBenchmark’s Optional MFA Scope Inventory
Use this worksheet as an organizational aid for the person checking the settings. The entries are questions to investigate, with room to record an unresolved answer.
| Area to check | Accounts or users checked | MFA method and requirement confirmed | Evidence, checker and date | Outstanding question |
|---|---|---|---|---|
| Business email | ||||
| File storage | ||||
| Remote network access | ||||
| Privileged or administrator access | ||||
| Other systems named in the application |
PolicyBenchmark suggests recording the relevant configuration description or report reference in the evidence column. Ask the IT owner to list any exceptions they identify and the accounts affected. Keep a blank or unresolved entry visible until someone has checked it.
If the team reports a planned change, record it separately from the settings checked today. After implementation, ask for a new check and date before revising the application answer. Keep the completed inventory with the version of the application it supports.
Separate the Security Check From Coverage Questions
The Federal Trade Commission’s cyber insurance guidance advises discussing a company’s needs with its insurance agent, including first-party coverage, third-party coverage or both. It also raises coverage questions involving attacks on data held by vendors and other third parties.
PolicyBenchmark suggests keeping those policy questions beside the completed MFA inventory. One section records what your IT team checked; the other records the insurance wording you want clarified. Give unresolved configuration questions to the technical owner and unresolved application wording to the insurer.
Related pages: Cyber Insurance: First-Party and Third-Party Coverage, Exclusions and Cost Factors and Business Insurance Assessment.
Have a question about your own situation? Send it to PolicyBenchmark.
About this article
- Published by
- PolicyBenchmark Editorial Team
- Published
This content is for informational purposes only and does not constitute insurance advice. Always consult with a licensed insurance professional before making coverage decisions.