Multi-factor authentication checklist: what underwriters accept

Multi-factor authentication is the control underwriters ask about most. Many insurers restrict or decline cover without it, and some forms ask about it one access path at a time. A single "yes" on the form has to hold true for every user and every way in.

At claim time, the question gets sharper. If an attacker came in through an account you said had MFA, expect the claims team to look closely at that answer. This checklist helps you make sure the answer is true, and that you can prove it.

Cover every access path

• Enforce MFA on email and webmail for all usersEmail is the most common way in. A conditional access policy export or an admin screenshot showing enforcement for all users is the usual evidence.
• Require MFA on VPN, remote desktop and virtual desktopsRemote access is a favourite entry point for ransomware. Show the VPN or gateway setting that requires a second factor.
• Protect admin and domain admin accounts with MFAAttackers aim for these accounts first. Underwriters often ask about them as a separate question.
• Turn on MFA for every cloud admin consoleThat covers admin access to Microsoft 365, Google Workspace, AWS and Azure. A screenshot of each console's security setting satisfies most reviewers.
• Put MFA on the backup consoleAn attacker in the backup console can delete your way back. Many ransomware questionnaires ask about this directly.
• Require MFA on your IT provider's remote toolsManaged service providers use remote management tools with wide access to your systems. Ask your provider for written confirmation and keep it on file.

Close the gaps underwriters probe

• List every account excluded from MFA, with a reasonMany forms ask you to name exceptions. A short register with an owner and a fix date shows you have them under control.
• Block legacy sign-in methods that skip MFAOlder protocols, such as basic authentication for POP or IMAP, can let attackers bypass the second factor. A policy export showing them blocked answers the question.
• Stop service accounts signing in interactivelyService accounts often cannot use MFA, so they need other limits. List them and show interactive sign-in is blocked.
• Include contractors and guest accountsMany forms say "all users, including third parties". Put guest and contractor accounts under the same policy as staff.
• Keep emergency admin accounts few and watchedStore their long passwords in a vault and alert on every use. Explain them to the underwriter before they ask.

Choose factors that hold up

• Use authenticator apps or hardware keys ahead of SMSAttackers can intercept text codes or redirect them through a SIM swap. Some insurers ask which methods you allow.
• Turn on number matching for push approvalsAttackers send repeated push prompts until someone taps approve. Number matching makes that trick much harder.
• Give each person their own MFA deviceA shared phone means nobody can tell who signed in. Personal factors keep the audit trail clean.

Keep the evidence current

• Export your MFA settings every three monthsSettings drift as staff join and systems change. Underwriters want the setting as it stands today, and a quarterly export keeps your file fresh.
• Add MFA to your joiner processNew staff should have MFA from their first day. Add it to the onboarding checklist and keep a sample record.
• Review sign-in logs for MFA failures each monthRepeated failed prompts can mean someone holds a stolen password. A monthly look at the sign-in report shows the control works in practice.

Broker's tip

The word underwriters care about is "all". When a form asks whether MFA covers all users and all remote access, your yes includes the forgotten admin account and the old VPN as well. Before you tick the box, ask your IT provider to list every way into your systems and confirm MFA on each one in writing. If one path is still open, declare it with a fix date. Check your wording, or ask your broker, on how the insurer treats an answer that turns out to be wrong.