Security questions you cannot answer

The situation

Your cyber insurance renewal asks whether every account uses multi-factor sign-in, how often backups are tested, and who has administrator access. A larger client sends a vendor security questionnaire with fifty more questions like it.

Ticking yes to everything is risky. If an answer turns out to be wrong, it can cause problems later with a claim or a contract. But nobody on your team knows the real answers.

How we approach it

We work through the questions with you and your IT provider, checking each answer against how your systems are actually set up. Where the honest answer is no, we say so and explain what it would take to change it.

Common gaps, like accounts without multi-factor sign-in, shared admin passwords, or former staff who still have access, are often quick to fix. We prioritize those before the form goes back.

What you end up with

• Answers you can stand behind, with notes on how each one was checked.
• A short list of security gaps, ranked by risk and effort.
• A record you can reuse for the next renewal or questionnaire.

We do not give legal or insurance advice, and we cannot promise coverage or approval. Our job is to make sure the technical answers are accurate.

Rough timeline

Usually one to three weeks, depending on the length of the questionnaire and how quickly your IT provider can confirm details. Fixing the gaps is scoped separately.