Cyber Insurance Prep Checklist

Turn on MFA for all mailboxes (in Microsoft 365, enforce it via a Conditional Access policy or Security Defaults; in Google Workspace, enforce 2-Step Verification). Evidence: export the per-user MFA registration report and keep a screenshot of the enforcement policy showing it applies to all users.

Place every remote-access path behind MFA (VPN client, RDP gateway, SSH bastion or jump host). Evidence: capture the MFA configuration screen for each gateway and a sample authentication log showing the second factor being challenged.

Enforce MFA on all admin roles — domain admins, M365 Global Admins, server local admins, and SaaS admin consoles. Evidence: list your privileged accounts and show MFA is registered on each; a Conditional Access policy scoped to admin roles is the cleanest proof.

Enable MFA on every cloud root/owner and admin login — AWS root and IAM users, Azure/Entra admins, M365 admin center. Evidence: screenshot each console's MFA status page (e.g. AWS IAM credential report showing mfa_active, Entra authentication-methods report).

Confirm backups run at minimum weekly to media that ransomware can't reach — immutable cloud storage, object lock, or offline media. Evidence: keep the backup schedule configuration and a recent job-success report showing the cadence and the immutability/offline setting.

Ensure at least one backup copy lives outside the production environment so a single breach can't destroy both. Evidence: document the backup architecture (the "3-2-1" copy showing the offsite/cloud location) and capture the storage configuration confirming separation.

Perform an actual test restore — recover a file set or system and confirm it works; a backup you've never restored is not a backup. Evidence: keep a dated restore-test record noting what was recovered, by whom, and the outcome. Underwriters frequently ask for the date of your last successful test.