Resources
Minimum requirements to be insurable in cyber risk
A few years ago, these controls improved the premium. Today they are the entry point: without them, most insurers do not issue an offer. Review them before requesting a quote, not after.
Identity and access
- Two-factor authentication for all remote access, without exceptions.
- Two-factor authentication for corporate email and administration panels.
- Administrator accounts separate from daily use accounts.
- Periodic review of permissions and immediate deactivation of departing staff.
- External provider access must be nominal, temporary, and audited.
Backups
- At least one backup disconnected from the network or immutable.
- Backups outside the domain, so that a compromised credential cannot reach them.
- Full restoration test conducted and documented in the last six months.
- Restoration time known and compared with what the company can withstand being halted.
Protection and detection
- Endpoint detection and response solution, with managed monitoring.
- System and application updates with a defined timeframe for critical vulnerabilities.
- Network segmentation that isolates production, office, and industrial systems.
- Email filtering with protection against domain spoofing.
- Centralised event logging with sufficient retention for forensic analysis.
Organisation and response
- Written incident response plan, with appointed responsible parties and tested.
- Critical contacts accessible outside corporate email and on paper.
- Double verification through a different channel for changes to supplier bank accounts.
- Periodic staff training with email fraud simulations.
- Inventory of critical technology suppliers and the data they handle.
Double verification of bank account changes is the cheapest control on this list and the one that prevents the most impersonation frauds.
More resources
Other working lists
ChecklistInsurance programme renewal checklistThe checks we perform before going to market, to approach renewal with documented risk and real negotiation margin.ChecklistProtocol for action in the event of a claimWhat to do, in what order and with what deadlines during the first hours. Designed to be printed and kept outside the computer.ChecklistReview of capital for an industrial risk.How to review building, machinery, stock, and gross margin to avoid discovering underinsurance on the day of the claim.