Business 
Information Risk Management

Solutions & Services

IDENTIFY - PROTECT - DETECT - RESPOND - RECOVER

Small Organizations

These basic requirements are applicable to smaller and lower risk organizations (under $20mn revenue). For Large Organizations see below.

E-mail Security
  • Turn on Multifactor Authentication for all users of the email system

Recommended but not required: 

  • Deploy an email protection solution to prescreen emails. 
☐
Backups
  • Deploy offsite or cloud backups for all critical data and systems
  • Assure those critical systems, applications and processes can recover in 10 days or less

Recommended but not required: 

  • Use backups that continuously test restore to a virtual machine
  • Use “immutable backups” that cannot be changes
☐
Network Security
  • Deploy Multi-factor Authentication (MFA) for all admin access and on any remote access
☐
Patching
  • If the applicant is a retailer, restaurant, or online retailer, deploy end-to-end or point-to-point encryption on all point-of-sale (POS) terminals

Recommended but not required: 

  • Encrypt all sensitive information at rest 
  • Encrypt all sensitive information on mobile devices & laptops 
☐
Endpoint Security

Recommended but not required:  

  • Deploy an endpoint detection and response (EDR) solution
☐
Security Awareness Training

Recommended but not required: 

  • At least annually, do security awareness training for all employees
  • At least annual training for executives and key accounting on fraudulent transfer schemes
☐
Processes and Procedures for Wires and Funds Transfers
  • Put in place controls that require all funds and wire transfers over $25k to be authorized and verified by at least two employees before execution

Recommended but not required: 

  • Prevent unauthorized employees from initiating wire transfers
  • Verify vendor/supplier bank accounts before adding them to accounts payable systems
  • Require out-of-band authentication before the execution of all electronic payments
☐
Receive a Custom Quote

Cyber Security Best Practices

Insurance carriers increasingly look for and even require companies to implement specific cybersecurity 
practices to qualify for coverage.
SCHEDULE A CONSULTATION

Large Organizations

These best practices are applicable for larger organizations ($20mn+ revenue) or deemed higher risk for cyber attacks or those with prior cyber incidents.

Email Security
  • Turn on Multifactor Authentication for all users of the email system 
  • Tag external emails to alert employees that a message originates from outside the organization 
  • Deploy an email protection solution to prescreen emails. Deploy a specific email security provider (Ask an InfoAdvisor™ for recommendations)
  • Deploy an email security solution to automatically detonate and evaluate all attachments in a sandbox to determine if they are malicious before delivery 
  • Implement the following to protect against phishing messages: Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain Based Message Authentication Reporting and Confirmation (DMARC) 
  • Remove access or enforce MFA for all email access on the web application or non-corporate devices 
  • If you use Microsoft Office 365, Enable the Advanced threat protection to add on
☐
Cloud and Data Protection
  • If you use a cloud provider to store data and host applications, ensure they are large, reputable, and have proper controls. (AWS, Azure, Google)
  • Use MFA to secure all cloud provider services 
  • Encrypt all sensitive and confidential data on your systems and networks 
  • Where that is not possible, segment servers with sensitive and confidential data and put in place access control with role-based assignments 
  • Remove all remote access to your networks or use MFA to secure all remote access, including any RDP

☐
Authentication and MFA
  • Deploy Multi-factor Authentication (MFA) for all admin access and privileged accounts
  • Deploy MFA on any remote access, including any RDP connections
  • Use a reputable and trusted MFA provider (Ask an InfoAdvisor™ for recommendations)
  • Use an MFA type that is ideally not SMS or push-based 
  • Ensure that your MFA configuration is set up such that the compromise of a single device will only compromise a single authenticator
  • Deploy a privileged account management software (Ask an InfoAdvisor™ for recommendations)
  • Monitor all administrator access for unusual behavior patterns
☐
Asset Tracking & Configurations
  • Deploy hardened baseline configurations across all servers, laptops, desktops, and managed mobile devices
  • Record and track all software and hardware assets deployed across the networks
☐
Backups
  • Deploy offsite or cloud backups for all critical data and systems
  • Assure those critical systems, applications and processes can recover in 10 days or less
  • Use backups that continuously test restore to a virtual machine to assure the integrity and viability of the backups
  • Encrypt your backups
  • Use “immutable backups” that cannot be changes
☐
Network Security
  • Use protective DNS to block access to known malicious websites (Ask an InfoAdvisor™ for recommendations)
☐
Monitoring & Response
  • Utilize a SIEM of SOC Solution
  • Have an outsourced SOC Monitored 24-7
☐
Patching
  • Implement a vulnerability management tool (Ask an InfoAdvisor™ for recommendations)
  • Have a formal 30-day patching cadence, with critical and zero-day patching applied within seven days.
  • Remove all end-of-life or end-of-support software (If not possible, segment these from the rest of the network)

Recommended tools include:

  • Implement PowerShell best practices as outlined in the Environmental Recommendations by Microsoft
☐
Application Security
  • Remove all local admin rights from all non-IT users
  • Remove the ability to run Microsoft Office Macro-enabled documents on their system by default
  • Use endpoint application isolation and containment technology on all endpoints
☐
Encryption
  • If the applicant is a retailer, restaurant, or online retailer, deploy end-to-end or point-to-point encryption on all point-of-sale (POS) terminals

Recommended but not required: 

  • Encrypt all sensitive information at rest
  • Encrypt all sensitive information on mobile devices & laptops
☐
Endpoint Security
  • Deploy an endpoint detection and response (EDR) solution

Recommended solutions include:

  • Use an EDR solution that provides for centralized monitoring and logging of all endpoint activity across your enterprise
  • Enforce application whitelisting/blacklisting
  • Deploy EDR across 100% of endpoints, including mobile devices and BYOD, if they can access the corporate network
☐
Security Awareness Training
  • At least annually, do security awareness training for all employees that include social engineering and phishing simulation
  • At least annual training for executives and key accounting on fraudulent transfer schemes
☐
Processes and Procedures for Wires and Funds Transfers
  • Put in place controls that require all funds and wire transfers over $25k to be authorized and verified by at least two employees before execution
  • Prevent unauthorized employees from initiating wire transfers
  • Verify vendor/supplier bank accounts before adding them to accounts payable systems
  • Require out-of-band authentication before the execution of all electronic payments
☐

These requirements are not universal across all carriers; sometimes, a company can secure coverage without all these requirements. But aligning to these best practices will ensure a company gets the most and best-priced market coverage options.

Powered By:

Receive a Custom Quote

Contact Us

Share by: