Skip to content

Cyber insurance and Microsoft 365

Answer your cyber insurance questionnaire with evidence behind every answer.

We check which of your insurer's questions your Microsoft 365 actually meets, close the gaps and provide the matching report for every answer.

Book an introductory call How it works
For
Companies with 50 or more employees on Microsoft 365
Checked
MFA, EDR, patching, backup, admin rights, logging, email protection
Access
Read-only, removed afterwards
Outcome
Current state with evidence per question, prioritised roadmap
Price
from €3,500, fixed price for the Security Assessment

Sound familiar?

When is a look into the tenant worth it?

For companies with 50 or more employees on Microsoft 365 that want to answer their questionnaire the way it can be evidenced.

Renewal is coming up

The questionnaire asks about MFA, backups and admin rights. The questions go to your IT team or service provider.

“Yes” is quick to tick

Whether MFA really applies without exception only shows in the settings of your tenant.

The answers carry the contract

An answer that turns out to be inaccurate after a claim can put your cover at risk.

From questionnaire to evidence

Which report backs which answer?

Every typical question maps to a setting in Microsoft 365 and a report that evidences it. Questionnaires differ by insurer; switch the view to see how gaps turn into an order of work.

Choose view
Your tenant Microsoft 365, Entra ID, Intune, Defender
read-only
Insurer questions Typical topics in the risk questionnaire
  1. 1 MFA for all accounts Setting: Entra ID › Conditional Access Review exclusions, block legacy authentication MFA for all accounts Partial Priority high Evidence: policy export with exclusions
  2. 3 EDR on all devices Setting: Defender for Endpoint Onboard missing devices EDR on all devices Partial Priority medium Evidence: device inventory with sensor status
  3. Patching with set deadlines Setting: Intune › Update rings, Defender Vulnerability Management Patching with set deadlines Met, report is filed Met Met
  4. 2 Protected, tested backups Setting: Microsoft 365 Backup, Azure Backup Set up backup, test restores Protected, tested backups Open Priority high Evidence: restore test log
  5. 4 Admin rights only when needed Setting: Entra ID › Privileged Identity Management Activate admin roles only when needed Admin rights only when needed Open Priority medium Evidence: role assignments, activation history
  6. Logging Setting: Purview › Unified audit log Logging Met, report is filed Met Met
  7. 5 Email protection Setting: Defender for Office 365, SPF, DKIM, DMARC Set DMARC to “quarantine” or “reject” Email protection Partial Priority medium Evidence: DMARC record with policy

Example. Each row links a typical question to the place in the tenant where it can be evidenced. Ordered by risk. Every closed gap ends with a report you file with the questionnaire.

Example: your tenant with Microsoft 365, Entra ID, Intune and Defender is collected read-only and checked against the typical questions in insurers' risk questionnaires. Question and setting: MFA for all accounts via Entra ID Conditional Access partially met; EDR on all devices with Defender for Endpoint partially met; patching with set deadlines via Intune update rings and Defender Vulnerability Management met; protected, tested backups with Microsoft 365 Backup and Azure Backup open; admin rights only when needed via Privileged Identity Management open; logging in the unified audit log in Purview met; email protection with Defender for Office 365, SPF, DKIM and DMARC partially met. Gap and evidence by priority: 1 review exclusions and block legacy authentication, evidence policy export with exclusions; 2 set up backup and test restores, evidence restore test log; 3 onboard missing devices, evidence device inventory with sensor status; 4 activate admin roles only when needed, evidence role assignments and activation history; 5 set DMARC to quarantine or reject, evidence DMARC record with policy.

How do you get answers you can evidence?

Three steps. After the Security Assessment, you decide how to proceed. Allow enough time for this before your next renewal.

  1. Fixed price, read-only

    Security Assessment

    We read your tenant and record the current state with evidence for each typical question.

  2. Following the roadmap

    Close the gaps

    We or your IT provider implement the open points in Microsoft 365, ordered by risk.

  3. Your choice

    Evidence every month

    With Managed Security you receive an evidence report every month.

Is your renewal coming up?

In a 30-minute introductory call we agree the scope, followed by a fixed-price proposal for the Security Assessment.

Request the fixed-price Security Assessment Book an introductory call

Where evidence usually falls short

Rarely because technology is missing, more often because of details. Every answer in the questionnaire should be backed by the matching report.

  • MFA is active, but individual accounts are excluded.

  • Backups run but have never been test-restored.

  • A plan for security incidents exists but is unknown to the people involved.

Frequently asked questions

Do insurers verify the answers technically?

This differs by insurer and policy. If you can produce the matching report from the tenant for every answer, you are well prepared either way.

What happens if an answer is wrong?

In Germany, the questions are part of the pre-contractual duty of disclosure under Section 19 of the Insurance Contract Act (VVG). Depending on fault, inaccurate answers can lead to withdrawal, termination or an adjustment of the contract. This is not legal advice.

We have an IT provider. Do we still need you?

The Security Assessment is an independent second opinion. Your provider can then implement the open points directly.

What does it cost?

The Security Assessment has a fixed price, from €3,500 depending on the size of your environment. We then quote the implementation based on the findings.

What can your tenant evidence today?

The Security Assessment gives you the current state with evidence for each typical question, at a fixed price.

Book an introductory call