Free Cyber Insurance Self-Assessment | Perth

0 of 6 answered

1.Is multi-factor authentication (MFA) enabled on email, remote access, and admin accounts?

No, MFA isn't enabled anywhere.MFA is enabled in a few places, but not consistently.MFA is enabled on email and remote access for all staff.MFA is enforced everywhere it's supported, including admin accounts.

2.What kind of endpoint protection is running on your devices?

Basic or default antivirus, if anything.Antivirus is installed, but we're not sure it's actively monitored.A proper antivirus/EDR product is deployed across most devices.A named EDR product is deployed and actively monitored across all devices.

3.Are your backups offline or immutable, and regularly tested?

We don't have a formal backup process.Backups run, but they're not offline/immutable and haven't been tested.Backups run and are occasionally tested, with at least one offline/immutable copy.Backups run regularly, are tested, and include an immutable or offline copy ransomware can't reach.

4.How up to date are your systems with security patches, especially internet-facing ones?

Patching is irregular or largely ignored.Patches get applied eventually, with no real tracking.Critical patches are applied within a few weeks, most of the time.Patches are applied promptly and tracked, especially for internet-facing services.

5.Do IT admins use separate accounts for admin tasks versus day-to-day email and browsing?

No - the same account is used for everything, including admin access.Mostly the same accounts, with a few exceptions.Admin accounts are mostly separated from everyday accounts.Admin accounts are fully separated, used only for admin tasks, and reviewed regularly.

6.Do staff receive documented, recurring security awareness training?

No formal training has ever been provided.New staff get a brief mention of security, nothing ongoing.Staff receive occasional security awareness training.Staff receive documented, recurring training, tracked for completion.

Answer all 6 questions to see your estimated result.

Why These Six Controls?

Since the wave of ransomware claims in 2021-2023, insurers have hardened what they require before issuing or renewing a policy. Multi-factor authentication, endpoint detection and response (EDR), tested offline backups, patch management, privileged access controls, and documented staff training are now the baseline most insurers check, not optional extras.

These are also the controls insurers examine forensically after an incident. If a control was ticked "yes" on an application but wasn't genuinely in place, that's one of the most common reasons claims are denied or policies voided entirely.

FAQs

Does a good result guarantee I'll get cyber insurance or a claim won't be denied?

No. This tool estimates your alignment with the controls insurers commonly require, based on your own answers. Insurers assess your environment independently, and exact requirements vary by policy and provider. It's a useful starting point, not a guarantee of cover or a paid claim.

How long does it take?

About 2 minutes. There are 6 questions covering the controls insurers most commonly check - MFA, endpoint protection, backups, patching, privileged access, and staff training.

Why does one weak answer bring my whole result down?

Because that's how claims actually get assessed. If you tick 'yes' to MFA on an application but it wasn't properly enabled everywhere, insurers can deny the claim or void the policy - a single major gap matters more than several strong areas.

Is my information saved or sent anywhere?

No. This self-assessment runs entirely in your browser - your answers and results aren't recorded, stored, or sent to us unless you choose to contact us afterwards.

What happens after I get my result?

You'll see an estimated result and which controls are holding it back. If you'd like help closing the gaps before you apply or renew, you can book a free consultation with our team.

Cyber Insurance Readiness Self-Assessment