The short version
- Whether MFA is required, and for which access paths, depends on the insurer and policy. Check email, remote access and privileged accounts separately in the application and in operations.
- A backup design should provide separate copies, protection against later alteration and documented restore tests. Compare it with the specific contractual requirements.
- Segmentation and controlled access limit possible paths of spread. The insurer’s documents determine which separation and evidence it requires.
- Contractually agreed duties may apply throughout the policy term. The consequences of a breach depend on factors including the contract, fault and its connection with the loss.
A few years ago a cyber insurance application looked like a form. Today it looks like a technical audit — and that is no accident: insurers have learned which claims they had to pay and which gaps sat behind them.
Multi-factor authentication: the question it hangs on
MFA can be a condition of insurance cover. Check email access, VPN and remote access, administrator accounts and privileged application access individually. The particular insurer must confirm whether exceptions are possible and which methods it accepts.
The actual contract also determines acceptable second factors. An existing MFA solution does not establish that every required account and method is covered. Document the method, scope and agreed exceptions.
Backup: the word that matters is “tested”
The 3-2-1 rule — three copies, two media, one off-site copy — is one possible starting point for a backup design. An offline or immutable copy and documented restore tests help assess recoverability. The actual contract determines whether this exact design is required.
A successful backup job does not establish successful recovery. Restore tests should therefore form part of operations; they are a contractual duty in the form actually agreed.
The points that sit in the network
These four technical checks also concern the network. They provide implementation guidance; the insurer sets binding acceptance criteria:
Separation of client and server networks
Separate workstations, servers and, where relevant, production according to protection needs and necessary data flows. VLAN separation can form part of that design.
Controlled access
Review SMB and RDP connections between security zones. Permit necessary access through appropriate rules and controlled administration paths; a blanket ban on all client-server connections would make some applications unusable.
Controlled remote access
Every path from outside — home office, IT provider, machine builder — needs MFA and a named authorisation. The forgotten maintenance link of a former supplier is the classic finding.
Traceable patch management
Document the process, tools, response times and updates actually installed. Include routers, firewalls and switches in that inventory.
These four points can also help answer supply chain questionnaires, but their requirements still need to be compared individually. More on that in the article about your customer’s NIS2 questionnaire.
The order that makes sense
Where everything cannot happen at once, we prioritise the actual risks and contractual requirements: close unprotected remote access paths, test recovery and restrict unnecessary traffic between networks. Effort and order depend on the existing environment.
One point often gets lost here: the answers in the application are assurances. Ticking what is about to be implemented moves the problem into the claim — where it is most expensive. How we build smaller networks so these questions are answerable is described on our page for smaller companies.
Sources
Every evidenced claim in this article can be traced here. The retrieval date shows how fresh the check is.
- Cyberversicherung — unverbindliche Musterbedingungenopens in a new tab
GDV · retrieved 6 October 2026
- § 28 VVG — Verletzung einer vertraglichen Obliegenheitopens in a new tab
Bundesministerium der Justiz / Bundesamt für Justiz · retrieved 6 October 2026