Free tools · No account required

Cyber Insurance Readiness Checker

Prepare the evidence behind your renewal answers.

Work through nine practical questions about your business scope and security controls. Get an action summary to discuss with your IT provider and broker. You can also include optional Cyber Essentials preparation questions with a separate summary.

How to use this check

Choose the answer that reflects the scope of the question, then say whether supporting evidence has been reviewed. A Yes answer is your declaration; it is not automatically checked or independently verified.

For Not applicable, record a brief reason to discuss with the responsible reviewer. Not sure and unanswered items stay visible as gaps.

Your answers stay in this page. The checker does not send them to CyberProva, save them to your account or upload evidence. Keep passwords, personal information and sensitive records out of the reason fields. Print your summary before leaving if you want a copy.

0 of 9 questions answered
1. Insurer wording and business scope

Have you checked the insurer's exact questions and definitions against your business scope?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Current proposal or renewal questions, policy conditions, business entities, critical systems and data, third-party dependencies, and any written clarification from your broker or insurer.

2. Multi-factor authentication

Is MFA enforced for the users and services in scope?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Entra Conditional Access or Security Defaults configuration, policy state, target accounts/apps, exclusions and authentication-method records. Confirm the form's scope beyond Microsoft 365.

3. Privileged access

Are privileged accounts protected?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Entra role assignments, separate admin accounts, MFA enforcement and emergency-access review. If PIM is used, include eligible roles, activation/approval settings and the necessary P2/Governance licensing.

4. Endpoint protection

Is endpoint detection and response deployed?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Defender for Business or the chosen EDR service: reconciled device inventory, onboarding and sensor-health reports, exclusions and the provider's review. A purchased licence is not a deployment record.

5. Backups and recovery

Are systems and data backed up and recoverable?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Backup scope, retention, access separation and isolation/immutability where claimed, plus a completed restore test. Explain which Exchange/SharePoint retention or recycle-bin features are used and what separate backup covers.

6. Email forwarding

Is external email forwarding controlled?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Exchange Online mailbox forwarding and inbox-rule review, applicable outbound anti-spam and mail-flow policies, external destinations and approved exceptions.

7. Monitoring and incident response

Are security incidents monitored and acted on?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Defender or other service alert coverage, redacted triage examples, monitoring responsibilities and hours, escalation contacts and tested response procedures.

8. Updates and vulnerabilities

Are devices patched and vulnerabilities managed?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Intune or other update policies, assignment/deployment results, device-compliance and vulnerability reports, unsupported software and outstanding exceptions.

9. Third-party suppliers

Are relevant third-party suppliers assessed?

Internal review is self-reported. This tool has not seen or validated the evidence.

Suggested evidence to review

Supplier and connected-application register, service responsibilities, assurance documents, permission reviews, review dates and unresolved actions. Microsoft 365 findings do not audit every supplier.

Also preparing for Cyber Essentials?

Include 8 extra preparation prompts to review with your IT provider. Their answers and counts stay separate from your insurance preparation.

Danzell v16.3; requirements v3.3, effective from 27 April 2026. Guidance checked 25 October 2026.

An independent preparation aid for the UK scheme, not the official questionnaire, an assessment or certification. Use the question set assigned to your IASME assessment and arrange certification through a Certification Body.

IASME: official Cyber Essentials question sets (English) · NCSC: Cyber Essentials requirements v3.3 (English)

You can create a summary before answering every question. Unanswered items remain outstanding. No score, pass/fail judgement or insurance recommendation is produced.

Keep the insurer's actual requirements in view

This checklist is a starting point. Your organisation's systems, data, suppliers and policy conditions determine the evidence you need. A technical setting alone does not establish that a control covers every relevant account, device or service.

Use current records with dates, scope, exceptions and a named reviewer. Discuss unclear declarations and changes in circumstances with your broker or insurer. Answering Yes here does not replace that discussion.

Read the Microsoft 365 insurance renewal guide (English) · Accessible renewal worksheet

Support your answers with evidence

See what your Microsoft 365 assessment can establish

Start a free CyberProva assessment for selected settings checks and supporting evidence. This public checklist does not scan Microsoft 365 or automatically transfer answers into a workspace.

Start a free assessment

Guidance behind the questions

Checked on 25 October 2026. Guidance informs these prompts; it is not a universal insurance standard.