Guide

How to answer a law firm cyber insurance questionnaire

Cyber insurance used to be a checkbox. Now the application asks direct technical questions, carriers verify the answers when a claim comes in, and answers you cannot back up put the coverage itself at risk. This guide walks through the questions small firms actually see, what an honest yes requires for each one, and what to do when the honest answer is no. I am not an insurance agent; this is the IT side of the form, which is most of the form.

Multi-factor authentication

The first question on nearly every application, and the one carriers care about most: is MFA enforced on email, on remote access, and on administrator accounts. The key word is enforced. Many firms have MFA available in Microsoft 365 and turned on for some people, and that is not a yes. An honest yes means a tenant policy requires the second step for every user, with no exceptions for the partner who finds it annoying, and you can export the policy that proves it.

Backups you have actually tested

Carriers ask three things: do backups exist, are they separated from the systems they protect, and have you tested a restore. The trap is the second and third. Files that only live in OneDrive sync are not separated, because ransomware that encrypts the desktop syncs the damage upward, and a backup nobody has restored from is a hope, not a control. An honest yes means separate, versioned copies and a restore you have actually performed, with a note of when.

Patching, and the machines nobody mentions

Applications ask whether operating systems and software are updated on a schedule, and increasingly whether anything in the office is past its end of support. The trap machine is the old PC in the corner that runs one thing, because it is exactly what the question is about. An honest yes means updates apply on a schedule you can describe, and nothing on the network runs an operating system its maker no longer fixes.

Endpoint protection

Most forms now ask about antivirus or endpoint detection on every machine, managed from one place. Free consumer antivirus installed machine by machine is technically an answer, but managed means someone sees an alert when a machine flags something, rather than the alert dying on a screen nobody watches. If each computer fends for itself, say so to your agent rather than rounding up to yes.

Email security: SPF, DKIM, and DMARC

More applications now ask about email authentication, and it is the control small firms most often fail without knowing. SPF, DKIM, and DMARC are three DNS records that tell the world which servers may send email as your firm. Without them, anyone can send an invoice from an address that looks exactly like yours, and wire fraud aimed at law firms starts exactly there. The records are checkable from outside your office in about a minute, which is why this is the first thing my free Security Check looks at. You can see a sample of what that looks like.

Access control and departures

Carriers ask who has administrator rights and whether accounts are removed when someone leaves. The honest yes here is procedural: day-to-day work happens in accounts without admin rights, and there is a step, written down, that closes accounts on the day a person departs. The firm that fails this question usually finds out during the claim, when the intrusion traces back to a paralegal account nobody closed two years ago.

When the honest answer is no

A no on the questionnaire is a fixable problem; a yes the records do not support is not. Every control above can be put in place at a small firm, and the usual order is MFA first because it is the cheapest and blocks the most, then backups with a tested restore, then patching and endpoint protection, then the DNS records. If your renewal has a date on it, start from the top of that list and tell your agent what is in progress; agents deal in trajectories more comfortably than they deal in surprises.

Then keep the evidence as you go: the exported MFA policy, the restore test note, the patch schedule. The renewal comes back every year, and the difference between a scramble and paperwork is whether the records already exist.