Book a pilot conversation

Readiness check

Where do you stand with an underwriter?

Eleven questions on the controls underwriters ask about first, and one about your policy. Five minutes, no login. You get a readiness score, the gaps in the order an underwriter sees them, and who usually owns each fix.

Start the check
  • Eleven questions
  • Five minutes
  • No login
  • Answers stay in your browser

Example result

Close. A few gaps to close first.

  • IAM-01 Multi-factor authentication IT
  • BKP-02 Restore tested IT
  • PAT-01 Patching within a month IT

Asked first

Underwriters read these before anything else. A no on one of them is usually a referral.

  1. 01Does everyone use multi-factor authentication for email, remote access and admin accounts?

    IAM-01The application asks this directly. A no is usually a referral.

  2. 02Is paid endpoint protection installed on every laptop, desktop and server?

    END-01Asked directly on most forms.

  3. 03Are critical and high patches applied within a month?

    PAT-01Asked directly. A lower limit can apply to unpatched software.

  4. 04Have you tested a restore of your key systems in the last six months?

    BKP-02Asked directly. A no is a referral on most forms.

Can lower a limit

A gap here can bring a sublimit or a lower limit for that kind of loss.

  1. 05Have you removed software the vendor no longer supports?

    PAT-02Losses from end-of-life software can fall under a sublimit.

  2. 06Are backups kept offline or in a separate cloud service, with separate admin credentials?

    BKP-01Ransomware cover depends on it.

Also asked

Most application forms ask these as well.

  1. 07Is all remote access behind a VPN or a protected gateway, with nothing exposed directly to the internet?

    NET-05Exposed remote access is the most common way in.

  2. 08Are leavers removed from every system within one working day?

    IAM-03Underwriters ask how access is managed.

  3. 09Has every member of staff done phishing training in the last year?

    END-03Asked on most forms. Evidence is a training record.

  4. 10Is your email domain protected against spoofing with SPF, DKIM and DMARC?

    END-06Payment fraud cover depends on it. This one can be checked from outside.

  5. 11Do you have a written incident response plan that names who must be told first?

    INC-01Late notification can reduce what the policy pays.

Your policy

This one is not scored. It picks the checklist to work through next.

  1. 12Do you hold cyber insurance today?

0 of 11 answered

Answer the eleven control questions to see your readiness score and your top gaps.

This check is a guide. It is not an insurance decision and PrismX does not make one. Your insurer decides eligibility, pricing, coverage and claims.