Cyber Insurance & Compliance
Readiness Checklist

The easiest, highest-impact protections every business should have.

• Multi-factor authentication is enabled for every Microsoft 365 or Google Workspace email account.
• Every business computer runs centrally managed antivirus or endpoint protection.
• Operating systems and common applications install security updates automatically.
• Every employee has an individual account rather than sharing usernames and passwords.
• Employees use a business password manager instead of reusing or saving passwords in browsers.

You have the basic protections in place. Continue to Level 2 to protect your most important systems and data.

These controls reduce the damage caused by stolen credentials, ransomware, and lost devices.

• Multi-factor authentication protects administrator, remote-access, banking, payroll, and other critical accounts.
• Every business laptop has full-disk encryption enabled using BitLocker, FileVault, or an equivalent tool.
• A properly configured business-grade firewall protects the office network.
• Client files, email, and other critical business data are backed up automatically.
• At least one backup is isolated from the main network so ransomware cannot modify or delete it.

Your core systems and data are protected. Continue to Level 3 to make sure those protections work consistently.

Strong security requires repeatable processes, not just security products.

• SPF, DKIM, and DMARC are configured for the company’s email domain.
• Incoming email is filtered for phishing links, malicious attachments, and impersonation attempts.
• Employees receive security-awareness training and know how to report suspicious activity.
• Employee access is reviewed regularly and removed immediately when someone leaves the company.
• A backup has been successfully restored and verified within the past 12 months.

You are consistently managing important security risks. Continue to Level 4 to document and prove your readiness.

The hardest level focuses on the documentation and evidence insurers, clients, and regulators may request.

• One named person is formally responsible for overseeing the company’s cybersecurity program.
• The company maintains a written information security program appropriate to its risks and regulatory obligations.
• A written risk assessment identifies sensitive information, likely threats, existing safeguards, and remaining gaps.
• A written incident-response plan explains who to contact, what actions to take, and how required notifications will be handled.
• Security controls and cyber-insurance application answers are reviewed at least annually and supported by current evidence.

You completed all four levels. Your business has many of the foundational controls and documentation commonly requested by cyber insurers, clients, and regulators.