Prove Your Cyber Insurance Answers: Commands for the Questionnaire Controls

Nothing exposed. Here’s how to produce evidence instead of opinions. Why it matters... in 2022 an insurer and a manufacturer agreed to an order rescinding a cyber policy and declaring it void from inception after the insurer said MFA protected only the firewall.

Evidence is the difference between a yes and a maybe. MFA... find the accounts that break your “yes” AWS IAM users with console passwords but no MFA- `aws iam generate-credential-report aws iam get-credential-report --query Content --output text | base64 -d \ That lists IAM users with a password and no MFA. It misses your identity provider, which is where most staff accounts live.

Export the same view from Okta, Entra or Google Workspace. The target list length is zero. EDR... diff the agents against the inventory Insurers care whether EDR is on every server, including the forgotten ones- sort -u assets.txt > a.txt Anything printed is a host your “yes” doesn’t cover.

Email authentication... anyone can check it, including the carrier Underwriters look for SPF, DKIM and DMARC, with DMARC set to reject. dig +short TXT _dmarc.example.com # want p=reject Exposed remote access... scan only what you own An analysis of published carrier forms says Beazley asks whether RDP is exposed to the internet.

# only scan IP ranges you own or are authorized to test Backups... keep a restore log A nightly job isn’t evidence. A dated restore is. echo "$(date -u +%FT%TZ) restore-test db=orders result=ok" >> restore-log.txt Package it One folder per control, one dated export per answer, one owner per folder.

Begin about 90 days before renewal and reconcile every answer with evidence. When the broker’s questionnaire arrives, your answers already exist. Not legal advice. Ask your broker and a coverage lawyer about rescission rules in your state.

Disclosure: I do security consulting at Snippipedia).