Skip to content
DownrightAdvisory
Get started

Free tool

Get ready for the cyber insurance application.

Answer a short set of questions about the controls insurers commonly ask about. Get a prepared answer sheet and a list of what to fix first.

0 of 19 answered

0 in place · 0 to fix

1. Multi-factor authentication (MFA)

A second step at sign-in, such as a code or an app prompt on your phone.

Does every person need a second step, not only a password, to get into their work email?
When staff connect from outside the office (VPN, remote desktop, your database, your file storage), is a second step required?
Do the accounts that can change settings, add users or reset passwords all need a second step?

2. Backups and testing

Copies of your data that you could restore from if everything else were lost.

Are the files and systems you could not work without copied somewhere else at least once a week?
Is at least one copy kept where an attacker inside your network could not delete or encrypt it?
Has someone actually restored files or a system from backup recently, to prove it works?

3. Endpoint protection (EDR)

Software on each computer that spots and stops attacks, beyond basic antivirus.

Does every computer and server run security software that watches for attacks and can be checked from one place?

4. Administrator accounts and access

Who can change settings, and what happens to accounts when people leave.

Do the people who manage your systems have one account for admin work and a different one for daily email and browsing?
Are staff signed in as standard users, so they cannot install software or change security settings themselves?
When someone leaves, are their sign-ins turned off the same day, every time?

5. Staff training

Helping people spot scams before they click.

Does every member of staff complete security training at least once a year, with a record kept?
Do you send practice phishing emails to staff to see who clicks, and follow up with those who do?

6. Incident response plan

What you would do, and who you would call, on a bad day.

Is there a written plan that says who does what if you are hacked or lose data?
Has the plan been walked through or updated in the past year?

7. Email security

Most attacks start with an email.

Is incoming email checked for dangerous links and attachments before it reaches staff?
Are the three settings in place that stop strangers sending email that looks like it came from your address?
If an email asks you to change where a payment goes, does someone call a number you already had to confirm it?

8. Patching and updates

Keeping software up to date closes the holes attackers use.

Are important security updates installed on computers, servers and network equipment within a month?
Is everything you run still supported and receiving security updates from its maker?

Your fix list, in order

Answer the questions above and your fix list builds here.

Get the prep pack by email

A PDF to work from when the application arrives:

  • Your fix list, in priority order
  • An answer sheet for the questions applications commonly ask
  • What evidence to have ready for each yes

Answer at least one question first. Privacy policy

Not insurance advice. A preparation aid, not insurance or legal advice. Applications differ by insurer, and this does not predict whether you will be offered cover or what it will cost. Answer every application truthfully and from your own records. Ask your broker about anything you are unsure of. Content version 1.0.0, last reviewed November 12, 2026.

Want help closing the gaps?

Downright sets up the controls on this list for small organizations: sign-in security, backups, device protection, and a plan for a bad day.

Ask about an assessment