What your cyber insurer will ask this year
Canadian underwriters have moved MFA, backups and EDR from the discount column to the eligibility column. This page is the checklist. The call is a free evidence review.
The questions you will fail on a Thursday
If you cannot evidence it, the honest answer is no. “We think so” is how renewals get declined or carved out.
01
MFA on remote access and email
Not “we turned it on for some people.” Coverage on VPN, Microsoft 365, and anyone who can change the controls.
Related work02
Isolated, tested backups
A copy the same admin account cannot delete, and a restore test with a date. A green backup job is not enough.
Related work03
Endpoint detection (EDR)
Something watching laptops and servers besides antivirus from 2018. They will ask the product name and whether anyone reviews alerts.
Related work04
Awareness in the last 12 months
A completion certificate from a video is weak. A simulation date and a click-through trend is stronger.
Related work05
Last penetration test or audit
Scope, date, and whether priority findings were retested. A scan export labelled “assessment” is a short conversation.
Related work06
Privileged access and the helpdesk story
How many global admins, who has local admin, and what happens at 2 a.m. They are buying your process, not your logo.
Related work
What you leave with
A scored list: pass, fail, or “cannot evidence.” Plus the order we would fix it before the binding date.
What we will not do
We will not tell you to lie on the form. We will not sell you a tool you do not need to tick a box.
If you want the work done
Identity and email often fit the 30-day offer. Backups, EDR and a pentest are quoted as their own pieces.
Free. Thirty minutes. Bring the questionnaire if you have it.
Toronto and Vancouver. Brokers welcome on the call.
- No managed-service agreement required to have the conversation.
- Not for consumer policies or personal home cyber add-ons.
For the owner and the broker
Is the review really free?
Yes. Thirty minutes, on a call. We tell you which questions you will fail and what would close them. Remediation is quoted only if you ask for it. You are not on the hook for a managed contract.
Can our broker sit in?
Please do. Brokers in the GTA and Metro Vancouver use this so the application is not guesswork. We will speak to the form, not to a product pitch.
What do we need to bring?
Whoever knows the tenant. Screenshare of Microsoft 365 or your backup console helps. If you have last year’s policy wording or the new questionnaire, send it ahead.
What if we fail half the list?
That is the usual result. We sequence the work: identity and email first (often the 30-day offer), then backups, then testing. You decide how much to do before the binding date.
Renewal in the next 60 days?
Do not wait for the broker’s third reminder. Book the review while there is still time to close the gaps.