A black box for cyber risk, like the one in car insurance.

Shows the business is a good risk, with managed processes.

1. Third-party risk

   Vendor risk register

   Do you keep a risk register of your key software and service vendors?

   Yes No

2. Certifications

   Certifications held

   Which of these security certifications does your organisation hold?

   ISO 27001 (information security) ISO 42001 (AI management) Cyber Essentials Plus Cyber Essentials SOC 2 Type II SOC 2 Type I ISO 22301 (business continuity) PCI DSS (payment card security)

3. Incident response

   Incident response plan

   Do you have a formal, documented incident response plan?

   Yes No

4. Incident response

   Tabletop exercise

   Has the plan been tested in a tabletop exercise in the last 12 months?

   Yes No

5. Security awareness training

   What percentage of your staff have completed security awareness training in the last 90 days?

   0%

Multi-factor authentication is the first requirement for almost every UK and global underwriter.

1. Multi-factor authentication (MFA)

   MFA for remote accessKnock-out

   Is MFA enforced for every employee for remote access, such as VPN or Citrix?

   Yes No

2. Multi-factor authentication (MFA)

   MFA for email and cloudKnock-out

   Is MFA enforced for every employee for email and cloud apps, such as Microsoft 365 or Google Workspace?

   Yes No

3. Multi-factor authentication (MFA)

   MFA for admin accountsKnock-out

   Is MFA enforced for all privileged and admin accounts?

   Yes No

4. Service accounts

   Service accounts without MFA

   Are any service accounts with domain admin rights exempt from MFA?

   Yes No

5. Service accounts

   Service accounts without password rotation

   Are any service accounts with domain admin rights exempt from password rotation?

   Yes No

6. Leavers

   Does a technical workflow make sure accounts are disabled within 24 hours of someone leaving?

   Yes No

Sets how severe a claim becomes. Backups that cannot be deleted are non-negotiable.

1. Backups that cannot be deletedKnock-out

   Are your main backups immutable, or under a legal hold, so they cannot be deleted even if an admin account is compromised?

   Yes No

2. Restore testing

   Can you show a report of a successful data restore test in the last six months?

   Yes No

3. Data leaving the business

   Monitoring large transfers

   Do you monitor large, unauthorised transfers of data to personal cloud storage, such as Dropbox or WeTransfer?

   Yes No

4. Data leaving the business

   Blocking large transfers

   Do you block large, unauthorised transfers of data to personal cloud storage?

   Yes No

Known, unpatched vulnerabilities are among the top three causes of breaches.

1. Patching critical vulnerabilities

   Do you have a policy to fix critical vulnerabilities (CVSS 9.0 and above) within 14 days?

   Yes No

2. Shadow IT

   Do you have a way to find unmanaged devices or web servers set up without IT's knowledge?

   Yes No

3. Out-of-support systems

   Is any system running out-of-support software, such as Windows Server 2012 or Windows 7, connected directly to the internet?

   Yes No

The front line. Endpoint detection and response is a baseline expectation.

1. Endpoint detection and response (EDR)Knock-out

   Is EDR installed on all of your laptops, desktops and servers?

   Yes No

2. Backup network

   Are your backup servers on the same network segment as staff workstations?

   Yes No

3. Cloud configuration alerts

   Does a tool alert you if a Microsoft 365 setting is changed to something less secure, such as turning off MFA for a user?

   Yes No

Gives continuing confidence that the controls actually work.

1. 24/7 security operations centre (SOC)

   Firewall logs

   Does a 24/7 SOC receive logs from your firewalls?

   Yes No

2. 24/7 security operations centre (SOC)

   Identity logs

   Does a 24/7 SOC receive logs from your identity provider, such as Entra ID, Active Directory or Okta?

   Yes No

3. 24/7 security operations centre (SOC)

   Cloud logs

   Does a 24/7 SOC receive logs from your cloud environment?

   Yes No

4. 24/7 security operations centre (SOC)

   Endpoint logs

   Does a 24/7 SOC receive logs from your endpoints?

   Yes No

5. Reporting to insurers

   Could you produce a security health report for an insurer within 24 hours of being asked?

   Yes No