How to answer the MFA question on a cyber insurance application

Cyber insurance applications commonly ask some version of one question: is multi-factor authentication enforced for email, remote access, and privileged accounts? Multi-factor authentication, usually shortened to MFA, is a second proof at sign-in, such as an authenticator app or a hardware security key, on top of the password.

The honest answer is often "partly." Partly is not a wrong answer. It is the accurate one for many small businesses the first time they check.

The question is asking whether a stolen password alone is enough to open the systems that matter most. The insurer wants the true state of each named system rather than one yes covering all of them.

The way to answer it well is to check each system in turn, write down what is and is not covered, and say so plainly. If you answer "MFA is enforced on email and the accounting system, and is being rolled out to remote access this quarter," you are describing your position accurately. If you guess yes and are wrong, you have put a statement on the form you cannot support.

The three places the question usually names

Email. This is the account an intruder wants most, because it is the recovery route for nearly every other login your business holds. For email, enforced means every mailbox requires a second step to sign in, with none left out, and the option does not sit unused in a settings menu.

Remote access. This covers whatever lets your staff reach your business systems from outside the office, such as a virtual private network (VPN), a remote desktop connection, or a cloud login used off-site. For remote access, the connection itself must check for a second factor, not only the account it eventually hands off to. A VPN appliance or a remote-access gateway often keeps its own list of accounts, separate from the business's identity provider. An identity provider is the system that holds the master list of logins. A policy switched on for email and cloud applications can still leave that gateway checking a password alone.

Admin or privileged accounts. These are the logins that can change settings for every other account. They include the administrator of the email system, the person who can add or remove users, and any member of staff with ongoing access to the backup console or the domain registrar. A domain registrar is the company where the business's web address is registered. Enforcement matters most for these accounts, because one of them can turn off MFA for every other account on the list.

Across all three, enforced has one meaning: required by a central policy that applies automatically, not offered as an option a member of staff can decline.

How to check in an afternoon

Checking does not call for specialist tools. You can confirm most of it from an admin console you already use.

Microsoft 365. Sign-in is managed in Microsoft Entra ID, formerly Azure Active Directory, through the Microsoft Entra admin center. Conditional Access is the Entra ID feature that sets sign-in rules for accounts. Look for a Conditional Access policy requiring MFA for all users. Where your business does not hold the licensing that Conditional Access needs, confirm instead that security defaults are turned on. Security defaults require every user to register for MFA and block legacy authentication. Legacy authentication means older sign-in methods, used by some older email programs, that cannot ask for a second step. Security defaults do not challenge every sign-in, though. Administrators meet the second step every time they sign in, and other users meet it when Microsoft judges it necessary. Describe that accurately on the application, rather than as a second step on every mailbox.

Three further checks apply to Microsoft 365. Read the sign-in logs to confirm that accounts are being challenged, not only covered on paper. Where Conditional Access is in use, confirm separately that legacy authentication is blocked. Confirm too that app passwords are not enabled. An app password lets an older application sign in without ever meeting the second step.

Google Workspace. In the Google Workspace admin console, under Security and then Authentication, confirm 2-Step Verification is set to enforced for all users rather than left as an option. Check which method each account uses. The user security report under Reporting shows which accounts are enrolled, so you can read coverage against the policy rather than assume it.

The VPN or remote desktop. Sign in to the appliance or gateway's own console rather than assuming it inherits the company-wide policy. Where it can be connected to your identity provider, connect it so the same rule applies. Where it cannot, confirm it requires a second factor of its own, and keep its account list short.

The accounting system. Open its admin or security settings and look for an option to require two-factor authentication, often labeled 2FA, for every user rather than your own login alone. This system moves money directly, so it belongs on the same list as email and remote access, even where the application does not name it.

The administrator of each system can usually answer these in a few minutes. Where an outside IT provider holds that access, put the same questions to that provider. Ask for evidence, such as a screenshot of the coverage report, rather than a verbal assurance.

What to write when the answer is "partly"

Most applications include a comment field, and a specific answer there is worth more than an unqualified yes or a bare no. State what is covered and what is scheduled: "MFA is enforced on email and the accounting system. Remote access is scheduled for next month." That tells the insurer you know your own position and are closing the gap. A single yes or no cannot convey that.

Keep the evidence that backs your answer, in case it is requested later or a claim turns on it. The usual form is a coverage report from whichever system administers logins, showing which accounts require a second factor and which do not. A control that exists in writing but is not enforced is not a yes, whatever the policy says.

Closing the gap, in order

Where coverage is incomplete, the order that closes the largest exposure first is usually:

1. Give every person their own named login and retire shared accounts, starting with anything that can move money or reach customer data.
2. Turn on MFA for email and banking first, then payroll, accounting, remote access, and the main cloud applications.
3. Prefer an authenticator app or a hardware security key over text-message codes, which NIST classes as a restricted authenticator because they travel over the public telephone network (NIST SP 800-63B-4). Record a backup sign-in method for each person so a lost phone does not lock that person out.
4. Enforce MFA through a central policy rather than per-user opt-in, and check coverage twice a year, since new accounts and applications are where coverage can lapse.

That is the order, not the method. Choosing between an app, a key, and a text code, and handling the questions staff raise, is covered in rolling out MFA without the revolt.

For many small businesses, closing the gap on email takes an afternoon. Remote access can take longer where the gateway cannot connect to the identity provider.

Where this sits in NIST CSF 2.0

This question maps most directly to one outcome in the NIST Cybersecurity Framework 2.0: PR.AA-03, "Users, services, and hardware are authenticated." It sits in the Identity Management, Authentication, and Access Control category of the Protect function (NIST CSWP 29, February 26, 2024). NIST's CSF 2.0 implementation examples list "Require multifactor authentication" first for that outcome (CSF 2.0 Reference Tool).

Where to start

Answering this one question accurately does not establish where the rest of your business stands, and an insurer's application is rarely the only place these questions get asked. The free ten-question health check gives a first read on MFA alongside nine other priority controls. From there, the full self-guided assessment covers all 106 outcomes in the framework, in the detail an application, a customer's security questionnaire, or your own planning needs. It produces a prioritized list rather than a single yes or no, and it prepares you for a consultant-led assessment rather than replacing one. Where neither you nor your IT provider can describe your systems with confidence, a review of those systems by an advisor is the better first step.

No assessment and no guide can promise a particular premium or a policy being issued. The insurer decides that. What an accurate answer, backed by evidence, does is remove uncertainty and give you a true account of your own position.

For the full list of questions a cyber insurance application typically asks, and how to approach them, see how to answer your cyber insurance questionnaire.