Cyber Insurance Readiness Scorecard
Use ten questions to inventory common security-control evidence before renewal. The result is a planning aid, not an underwriting decision; confirm the current questionnaire with your broker and insurer.
Cyber insurance applications and renewals are carrier- and policy-dependent. Questionnaires can ask for evidence about MFA, endpoint security, backups, training and other controls. This scorecard is a practical inventory based on our guide to cyber insurance requirements; it does not reproduce or replace a carrier questionnaire.
How to answer: pick Yes only when the control is documented across the relevant environment. Pick Partially when coverage or evidence is incomplete. Pick No when the control is absent. Then compare the result with the current questionnaire and ask your broker or insurer about anything unclear.
Private by design. This runs in your browser. Nothing is sent or stored.
Is MFA enforced on every email account?
Every mailbox in Microsoft 365 or Google Workspace, including shared mailboxes and executives. Enforced by policy, not left to each user to opt in.
Is MFA enforced on all remote access and all admin accounts?
VPN, remote desktop, and every account with administrative privileges, including your IT provider's accounts. Record the actual scope and any exceptions for review against the current questionnaire.
Is EDR deployed on every workstation and server?
Endpoint detection and response, not just traditional antivirus. Every laptop, desktop, and server, including that one machine in the shop nobody wants to touch.
Do you keep an offline or immutable backup copy?
At least one backup copy that ransomware with admin credentials cannot encrypt or delete: immutable cloud storage, or media that is genuinely disconnected.
Have you test-restored a backup in the last 6 months?
An actual restore of real data or a full system, with the result documented. A green checkmark in the backup software does not count as a test.
Are security patches applied on a monthly or faster cadence?
Operating systems and major applications patched on a defined schedule, with critical vulnerabilities handled faster. "When someone remembers" is a No.
Do all staff get security awareness training and phishing simulations?
Ongoing training plus simulated phishing emails, with completion tracked. A single lunch-and-learn two years ago does not qualify.
Do you have a written incident response plan?
A documented plan that names who does what during an incident, with contact details, and that has been reviewed or walked through in the last year.
Do you have centralised logging or 24/7 MDR monitoring?
Security logs collected in one place and reviewed, or a managed detection and response service watching your environment around the clock.
Is your environment free of end-of-life software?
No operating systems or major applications past their support date in production: no Windows Server 2012, no Windows 10 without extended updates, no unsupported firewalls.
Fix first: your No and Partially answers
Before completing the real questionnaire: verify each answer against the current environment and the wording supplied by the carrier. Inaccurate or incomplete answers may affect an application, policy or claim. Ask your broker, insurer or legal adviser when interpretation is uncertain. Our cyber insurance requirements guide explains how to organize an evidence record.
Turn the inventory into a scoped plan.
North Star can verify the technical state, document available evidence and scope practical next steps. Your broker and insurer determine which controls and evidence apply to the policy.
MFA and EDR
Review account scope, policy enforcement and endpoint coverage; record exceptions and identify the evidence your current questionnaire requests. North Star can scope MFA and endpoint-security work through our managed cybersecurity service.
Backups and patching
Document backup scope, retention, protection and dated restore tests, then compare the record with the application wording. Review patch cadence and exceptions rather than relying on a dashboard status alone.
Training, IR, and the paperwork
Inventory training records, incident-response ownership, monitoring and unsupported systems. We can help verify technical answers and assemble evidence through our cyber insurance questionnaire support; policy interpretation stays with the broker or insurer.
Quick answers.
Is this scorecard the same as a real cyber insurance questionnaire?
No. It is a plain-language planning inventory covering common evidence topics. Carrier and policy questionnaires vary, and only your current application, broker and insurer can confirm what applies. Use the scorecard to organize questions and evidence before renewal.
Does the scorecard send my answers anywhere?
No. The scorecard runs entirely in your browser. Nothing is sent to a server, nothing is stored, and there is no account or email gate. Refresh the page and your answers are gone.
Does a score determine whether we can get cyber insurance?
No. The planning score only summarizes the ten answers selected in this browser. It does not determine eligibility, coverage, pricing, policy terms, renewal or a claim outcome. Confirm current requirements and evidence with your broker and insurer.
Can North Star help review the items this scorecard identifies?
North Star can review the technical environment, document the current state and scope work for controls such as MFA, endpoint security, backups, patching, training and incident response. The insurer or broker remains the authority on policy requirements and outcomes.
More free tools
Need the answers verified?
Scope a technical assessment to compare selected answers with the actual environment, document evidence and price agreed remediation. Bring the carrier questionnaire so its exact wording guides the review.
Scope a Cybersecurity Assessment Read the full guide