Pre-Audit Questionnaire

Company & Insurance Carrier

General company info and current cyber insurance details

A1Company Name

A2Primary Contact Name

A3Contact Email

A4Contact Phone

A5Number of Employees

A6Industry / Sector

A7Current Cyber Insurance Carrier

If unknown, enter "Shopping / No current policy"

A8Policy Renewal Date (Approximate)

A9Current Annual Premium (Approximate)

A10Coverage Limit

A11Has the carrier provided a security questionnaire or prior feedback?

Yes — carrier sent questionnaire Received some feedback at renewal No — no feedback received

Identity & Multi-Factor Authentication

MFA coverage, admin accounts, and privileged access

B1Is MFA enforced for all user accounts (including email)?

Yes — all users Most users (80%+) Some users only Not deployed

B2Is MFA required for Global Admin / Domain Admin accounts?

Yes No Unknown

B3What MFA method is primarily used?

Authenticator App (Microsoft/Google) SMS / Text Hardware Token (YubiKey, etc.) Email code Conditional Access / SSPR

B4Do you have service accounts or application accounts? Are they excluded from MFA?

Service accounts exist and have MFA/controls Service accounts exist, excluded from MFA No service accounts Unknown

B5Do you have a Break-Glass (emergency admin) account that bypasses MFA?

Yes — exists and is monitored Yes — exists but not actively monitored No break-glass account Unknown

B6Identity platform(s) in use

Azure AD / Entra ID On-Prem Active Directory Google Workspace Okta Other

Backups & Immutability

Backup frequency, testing, immutability, and offsite/air-gap status

C1How frequently are production backups taken?

Continuous / Real-time Daily Weekly Monthly or less Unknown

C2Are backups stored in an immutable (write-once) format or location?

Yes — immutable storage confirmed Partially — some systems are immutable No immutable storage Unknown

C3Are backups stored offsite or in a separate cloud account (air-gapped from production)?

Yes — separate account/location Same cloud tenant, separate storage No — same environment as production Unknown

C4When was the last successful backup restore test performed?

Within last 3 months 3–12 months ago Over 12 months ago Never tested Unknown

C5Backup solution(s) in use

Azure Backup / Recovery Vault Veeam Datto Acronis Commvault Other

C6What is your documented RTO (Recovery Time Objective)?

Less than 4 hours 4–24 hours More than 24 hours No documented RTO

Infrastructure & Vendor Topology

Cloud, on-premises, and third-party technology stack

D1Primary infrastructure environment

Azure only AWS only On-premises only Hybrid (cloud + on-prem) Multi-cloud

D2Security and networking vendors in use (check all that apply)

Fortinet (firewall/SD-WAN) Palo Alto Networks Cisco / Meraki Microsoft Defender CrowdStrike SentinelOne Sophos Other EDR

D3Do you operate any Linux servers or workloads?

Yes — Linux in use No — Windows only Unknown

D4Do you use any managed service providers (MSP) for IT operations?

Yes — fully managed MSP Partial — MSP + internal IT No — internal IT only

D5Is there an endpoint detection and response (EDR) solution deployed on all endpoints?

Yes — all endpoints Most endpoints (80%+) Some endpoints No EDR deployed

D6Is there a documented vulnerability management / patch schedule?

Monthly patching cycle, documented Ad hoc — patched as available No documented schedule Unknown

Prior Incidents & Compliance Obligations

Security events, regulatory requirements, and ongoing obligations

E1Has your organization experienced any security incident in the last 24 months?

Yes — ransomware Yes — data breach / exfiltration Yes — business email compromise (BEC) Yes — other incident No incidents in 24 months

E2Was a cyber insurance claim filed for any past incident?

Yes — claim paid Yes — claim denied Yes — partial payout No claim filed N/A — no incidents

E3Regulatory / compliance obligations that apply to your organization

HIPAA (healthcare data) PCI-DSS (payment cards) GDPR (EU data subjects) SOX (public company / financial) CMMC / DFARS (federal contractor) TX SB 64 (Texas) None applicable

E4Is there a documented Incident Response (IR) plan?

Yes — documented and tested Yes — documented, not tested Informal process only No IR plan

E5Is there a Security Awareness Training program for employees?

Yes — ongoing / quarterly Annual only Onboarding only No formal training

E6Anything else you'd like us to know before the discovery call?

Company & Insurance Carrier

Identity & Multi-Factor Authentication

Backups & Immutability

Infrastructure & Vendor Topology

Prior Incidents & Compliance Obligations

Pre-Audit Summary