Our Cyber Insurance Renewal Asks if We Have MFA and EDR. What Do We Answer?

The renewal email from your broker has a form attached. Most of it is easy: revenue, number of employees, what you do. Then it asks: "Do you require multi-factor authentication for email, remote access and administrative accounts?" and "Do you use an endpoint detection and response (EDR) tool on all endpoints?" Yes or no.

It's tempting to tick yes and move on. You have that code-on-your-phone thing, and there's antivirus on the laptops. But those questions are more specific than they look, and the answers matter if you ever make a claim.

The short answer

1. Answer what's true today, not what you plan to do. "We're setting it up" is a no until it's done.
2. Check each part of the question. "MFA for email, remote access and admin accounts" is three questions. Yes means all three.
3. Antivirus isn't EDR. If you're not sure which you have, find out before you answer.
4. If the honest answer is no, tell your broker and ask what it does to the quote. Fixing it before renewal is often quicker than you'd think.

Why the answer matters more than the premium

The application becomes part of the policy. If the insurer finds after a claim that an answer wasn't true, it can try to rescind the policy, treating it as if it never existed.

That's what happened in a 2022 federal case, Travelers v. International Control Services. Travelers alleged that the company's application said it used MFA for email, remote access and its servers, and that after a ransomware attack it found MFA protected only the firewall. Travelers sued to rescind, and the company agreed: the court's order rescinded the policy and declared it void from its inception. That was a settlement, not a ruling, but it shows what insurers do when an answer turns out to be wrong.

What "Do you have MFA?" really means

Carriers ask about specific places MFA should be. Coalition's application, for example, asks which services enforce MFA: email; VPN, remote desktop or other remote access; and network or cloud administration and other privileged accounts. Marsh's twelve key controls list MFA for remote access and for administrator access as a minimum. In a small office, that usually means:

• Email: every mailbox, including the shared ones people sign in to and the owner's.
• Remote access: any VPN, remote desktop, or remote-control tool used to reach office computers from outside.
• Admin accounts: the Microsoft 365 or Google Workspace admin login, your domain registrar, your website host, and the firewall or router admin page.
• Backups and cloud consoles: the account that can delete your backups.

How to check in Microsoft 365

Many small tenants rely on security defaults. They make every user register for MFA, require it for admins every time, and block older sign-in methods that skip MFA. But for regular users Microsoft decides when to prompt, based on location, device and task, so not every sign-in asks.

If you pay for Microsoft 365 Business Premium, it includes Entra ID P1, and Microsoft says security defaults are probably not right for organizations with P1. You can use Conditional Access instead, with a policy that requires MFA for all users. That's the setup that lets you answer "MFA on all email access" with a clear conscience.

Also look at how people approve sign-ins. Microsoft now says text and voice codes are no longer positioned as secure authentication methods, and it stops providing them in Entra ID on February 1, 2027 for most users. CISA calls phishing-resistant MFA the gold standard: FIDO/WebAuthn sign-ins, which is what passkeys and security keys use, can't be phished the way a code can. Text codes still count as MFA on most forms, but an authenticator app or a passkey is the better answer.

What "Do you have EDR?" really means

Traditional antivirus looks for known bad files. Endpoint detection and response watches what's happening on the computer, flags suspicious behavior even when there's no known bad file, and lets someone isolate the machine or stop the process remotely. Microsoft's EDR overview describes it as near-real-time detection with response actions.

Our reading of Microsoft's documentation: the Microsoft Defender Antivirus built into Windows is the antivirus layer, not EDR. Microsoft Defender for Business lists EDR among its features, and Business Premium includes it. But the license alone isn't the answer: Microsoft's setup guide has you onboard each device to protect it. Servers need extra licenses.

To check: in the Microsoft Defender portal, go to Assets > Devices. Every work computer should be listed and onboarded. If the list is empty or missing laptops, the honest answer is no, or "partially".

If you use another security product, ask your provider in writing whether it's EDR and whether every endpoint has it.

The other questions on the form

• Backups: carriers ask whether you keep backups offline or on a separate network, and how often. A sync folder like OneDrive isn't a backup on its own; if ransomware encrypts your files, it syncs the damage.
• Email filtering: whether incoming mail is scanned for malicious links and attachments. Microsoft 365 and Google Workspace both do this; the question is whether it's tuned.
• Patching: whether updates install within a set time. Windows Update set to automatic covers most of it for a small office.
• Training: whether staff get regular phishing training. A yearly session with a record of who attended is the usual minimum.

If the honest answer is no

1. Don't guess and don't stretch. Write "no" or "partially" and add a note: "MFA on all email accounts; admin accounts in progress, due by June 1".
2. Talk to your broker. A no may raise the price or limit coverage, but a wrong yes can leave you with no coverage at all.
3. Fix the cheap ones first. Turning on MFA for every mailbox and admin account costs nothing in Microsoft 365 or Google Workspace and takes an afternoon for a small office.
4. Keep evidence. Save screenshots of your MFA settings, device lists and backup reports with the date. If you ever need to show the answer was true, you'll have it.

When to get help

• You can't tell from the admin center whether every account has MFA.
• You're paying for Business Premium but nobody onboarded the computers to Defender.
• The form asks about things you don't recognize, like privileged access management or an incident response plan.

We fill out security and insurance questionnaires with clients all the time, and our cybersecurity service covers the MFA, EDR and backup setup the forms ask about. Already have an IT person or provider? Our co-managed security adds EDR with 24/7 response, login monitoring and staff training alongside them, with documentation you can use on the application. If you'd like a second pair of eyes on yours, get in touch.

Related reading

• The Microsoft 365 Security Settings Small Businesses Never Turn On
• Phone Buzzing With Login Requests You Didn't Make? MFA Fatigue Attacks and How Passkeys Stop Them
• Do Your Backups Actually Protect You From Ransomware? A 10-Minute Check and the 3-2-1 Rule
• Does the FTC Safeguards Rule Apply to My CPA Firm? What a Small Firm Actually Has to Do