This is not an insurance offer and does not guarantee a payout. It is a list of facts worth having written down before you fill a questionnaire or file a claim.
Identity and access
- Is MFA on email and on admin accounts?
- Does admin use a separate account from daily work?
- Are former staff / vendor accounts disabled?
- Is there a list of people with “crown jewels” access (banking, invoicing, domain)?
Email and fraud
- Is there a second-channel procedure for bank-detail changes / urgent transfers?
- Do you know who may approve a payment above an agreed threshold?
- Are DMARC / SPF / DKIM configured (even in monitoring mode)?
Backup and continuity
- Where does the copy live and is it separated from production?
- When was something last restored from backup (date, what, who)?
- Would ransomware on one host automatically wipe the copy too?
Incident
- Who answers the phone outside office hours?
- Is the first contact written down (IT / external / counsel)?
- Do you know when to go to the bank vs the GDPR path? — role map
Vendors
- Does external IT / a software house have access with an end date? — checklist
- Is remote desktop behind MFA / VPN, not an “open port”?
How to use this list
Answer with facts, not slogans. “We are aware of threats” says nothing. “MFA on 28/30 accounts; two admin accounts without passkeys — planned for April” says something.
Help documenting the state: security assessment or the small-business security order.