Pre-Audit Questionnaire

Company & Insurance Carrier

General company info and current cyber insurance details

A1Company Name

A2Primary Contact Name

A3Contact Email

A4Contact Phone

A5Number of Employees

A6Industry / Sector

A7Current Cyber Insurance Carrier

If unknown, enter "Shopping / No current policy"

A8Policy Renewal Date (Approximate)

A9Current Annual Premium (Approximate)

A10Coverage Limit

A11Has the carrier provided a security questionnaire or prior feedback?

Yes — carrier sent questionnaire Received some feedback at renewal No — no feedback received

Identity & Multi-Factor Authentication

MFA coverage, admin accounts, and privileged access

B1Is MFA enforced for all user accounts (including email)?

Yes — all users Most users (80%+) Some users only Not deployed

B2Is MFA required for Global Admin / Domain Admin accounts?

Yes No Unknown

B3What MFA method is primarily used?

Authenticator App (Microsoft/Google) SMS / Text Hardware Token (YubiKey, etc.) Email code Conditional Access / SSPR

B4Do you have service accounts or application accounts? Are they excluded from MFA?

Service accounts exist and have MFA/controls Service accounts exist, excluded from MFA No service accounts Unknown

B5Do you have a Break-Glass (emergency admin) account that bypasses MFA?

Yes — exists and is monitored Yes — exists but not actively monitored No break-glass account Unknown

B6Identity platform(s) in use

Azure AD / Entra ID On-Prem Active Directory Google Workspace Okta Other

Backups & Immutability

Backup frequency, testing, immutability, and offsite/air-gap status

C1How frequently are production backups taken?

Continuous / Real-time Daily Weekly Monthly or less Unknown

C2Are backups stored in an immutable (write-once) format or location?

Yes — immutable storage confirmed Partially — some systems are immutable No immutable storage Unknown

C3Are backups stored offsite or in a separate cloud account (air-gapped from production)?

Yes — separate account/location Same cloud tenant, separate storage No — same environment as production Unknown

C4When was the last successful backup restore test performed?

Within last 3 months 3–12 months ago Over 12 months ago Never tested Unknown

C5Backup solution(s) in use

Azure Backup / Recovery Vault Veeam Datto Acronis Commvault Other

C6What is your documented RTO (Recovery Time Objective)?

Less than 4 hours 4–24 hours More than 24 hours No documented RTO

Infrastructure & Vendor Topology

Cloud, on-premises, and third-party technology stack

D1Primary infrastructure environment

Azure only AWS only On-premises only Hybrid (cloud + on-prem) Multi-cloud

D2Security and networking vendors in use (check all that apply)

Fortinet (firewall/SD-WAN) Palo Alto Networks Cisco / Meraki Microsoft Defender CrowdStrike SentinelOne Sophos Other EDR

D3Do you operate any Linux servers or workloads?

Yes — Linux in use No — Windows only Unknown

D4Do you use any managed service providers (MSP) for IT operations?

Yes — fully managed MSP Partial — MSP + internal IT No — internal IT only

D5Is there an endpoint detection and response (EDR) solution deployed on all endpoints?

Yes — all endpoints Most endpoints (80%+) Some endpoints No EDR deployed

D6Is there a documented vulnerability management / patch schedule?

Monthly patching cycle, documented Ad hoc — patched as available No documented schedule Unknown

Prior Incidents & Compliance Obligations

Security events, regulatory requirements, and ongoing obligations

E1Has your organization experienced any security incident in the last 24 months?

Yes — ransomware Yes — data breach / exfiltration Yes — business email compromise (BEC) Yes — other incident No incidents in 24 months

E2Was a cyber insurance claim filed for any past incident?

Yes — claim paid Yes — claim-review issue Yes — partial payout No claim filed N/A — no incidents

E3Regulatory / compliance obligations that apply to your organization

HIPAA (healthcare data) PCI-DSS (payment cards) GDPR (EU data subjects) SOX (public company / financial) CMMC / DFARS (federal contractor) TX SB 64 (Texas) None applicable

E4Is there a documented Incident Response (IR) plan?

Yes — documented and tested Yes — documented, not tested Informal process only No IR plan

E5Is there a Security Awareness Training program for employees?

Yes — ongoing / quarterly Annual only Onboarding only No formal training

E6Anything else you'd like us to know before the discovery call?

Cyber Audit Pro provides technical evidence review and readiness support. We do not guarantee insurance approval, premium reduction, claim payment, regulatory compliance, or breach prevention. This service is not legal advice, insurance advice, a formal compliance certification, or a penetration test.

Company & Insurance Carrier

Identity & Multi-Factor Authentication

Backups & Immutability

Infrastructure & Vendor Topology

Prior Incidents & Compliance Obligations

Pre-Audit Summary