My cyber insurance form asks about MFA. How do I answer honestly?
Updated October 30, 2026
Answer “yes” to an MFA question only where MFA is required for everyone who uses that system, with no exceptions. The questions ask whether a stolen password alone is enough to get into your accounts, and most forms ask about email, remote access, administrator accounts, and cloud apps separately. Check each one, answer each item on its own, and if part of it isn’t done yet, say so.
Steps
- List every place people sign in for work: email, remote access, accounting, payroll, banking, file storage, and your website and domain accounts.
- Check whether Microsoft 365 requires MFA, or only offers it. An administrator can see this in the Microsoft Entra admin center. Details below.
- Check who has actually registered, because anyone who never set it up is a gap even when MFA is switched on.
- Check whether older sign-in methods are blocked, since they can get around MFA entirely.
- Check the other apps one by one for a “two-step” or “multi-factor” setting you can require for all users.
- Write down what you found, with screenshots and the date. That’s your evidence if the insurer asks.
Details
What MFA is, in plain terms
MFA, short for multi-factor authentication and also called two-step sign-in, means signing in takes your password plus something else, usually a prompt or code on your phone. If someone steals the password, they still can’t get in without the second step. CISA, the U.S. government’s cybersecurity agency, urges organizations to use MFA on all accounts, especially email (CISA: Multifactor Authentication).
Not all MFA is equally strong, and some applications ask which kind you use. CISA ranks security keys and passkeys (phishing-resistant MFA) strongest, an authenticator app with number matching as a good choice for small businesses, and text-message codes as a last resort (CISA fact sheet: Implementing Phishing-Resistant MFA (PDF)).
“Enforced” means required, not available
The word that matters on most forms is enforced: if people can skip MFA, the honest answer isn’t a full yes. A typical form asks whether MFA is enforced on all email access, then asks the same about remote access, including VPNs. Here’s what each question is really asking:
- Email. Is MFA required for every mailbox, including shared ones people sign in to and the owner’s own account?
- Remote access. If anyone connects from outside through a VPN, remote desktop, or a remote-control tool, does that sign-in also need a second step?
- Administrator accounts. These can change settings or add users, so whoever controls them controls everything.
- Cloud apps and critical data. Your accounting software, payroll, banking, and file storage.
This isn’t insurance or legal advice, so talk to your broker about how your answers affect your coverage.
Where to check in Microsoft 365
In Microsoft 365, MFA is required if security defaults are on or a policy requires it for everyone. Many smaller businesses use Microsoft’s free security defaults, which require everyone to register for MFA and block older sign-in methods. Microsoft’s instructions show where to see whether it’s on (Microsoft: Security defaults). On plans that include it, the Authentication methods activity report shows which users have registered (Microsoft: Authentication methods activity).
Microsoft notes that older sign-in methods, used by some older mail apps and by printers that send email, don’t support MFA and can be used to get around it. That’s why security defaults block them. If they’re still allowed, “enforced on all email access” may not be true.
If the honest answer is “not yet”
Saying “not yet” beats guessing, and it’s common. Describe what’s in place, what isn’t, and when you expect to finish, then ask your broker how the insurer treats a partial answer. In our experience, turning on MFA for email and administrator accounts is often quick. The longer part is helping each person set up the app on their phone. Before you switch it on, set up a second administrator account so a lost phone can’t lock everyone out, then follow how to roll out MFA without locking your team out.
For new IT PLZ HELP clients, rolling out multi-factor authentication and a password manager is part of onboarding, and we document the setup, so you have something to show when the application comes around.
Where doing it yourself gets risky
- The one exception. A shared login, a scanner account, or the owner who “never got around to it.”
- Remote access you forgot about, such as a remote-control tool a former vendor installed.
- Text-message codes only, when a form asks what type of MFA you use.
- Only one administrator. Microsoft recommends keeping two spare administrator accounts for lockouts, so a lost phone doesn’t lock everyone out (Microsoft: Security defaults).
Signs it’s time for help
Get help if either of these is true. You can check the rest yourself.
- Your list from step 1 is long, or has several “don’t know” entries.
- Several people still need to set up MFA on their phones, and your renewal is close.
Today, make the list from step 1 and mark each place “required,” “optional,” or “don’t know.” Anything marked “don’t know” is the next thing to check before you sign the application. If the list gets long, or you’d like a second set of eyes before your renewal, we’re glad to go through it with you.
Book a free 20-minute fit check