Often, yes. Canadian cyber insurers ask about multi-factor authentication (MFA) on the application, and an insurance trade publication reported in 2022 that they were requiring it before qualifying a business for coverage. Whether it is a condition of your own policy is set by your insurer’s application and policy wording, so the answer you sign has to match what is actually switched on.
Insurers price the odds that they will pay a claim, and a stolen password is a cheap way into a business. With MFA switched on, two or more different authentication factors are needed to sign in, as the Canadian Centre for Cyber Security describes it, so a password alone stops being enough. The Insurance Bureau of Canada, writing for the federal Get Cyber Safe campaign, suggests enforcing MFA on all accounts and devices, and warns that without a proper cyber security plan some small business owners may find it challenging to secure cyber insurance coverage.
Canadian Underwriter, an insurance trade publication, reported in January 2022 that Canadian cyber insurers were requiring businesses to have MFA and cybercrime or data breach response plans in place before qualifying for coverage. Each insurer writes its own questions and conditions, which is why the application in front of you is the document that counts.
MFA questions tend to reach well past the staff email login. The Cyber Centre’s baseline controls for small and medium organizations say two-factor authentication should be required for important accounts such as financial accounts, system administrators, cloud administration, privileged users and senior executives, and used wherever possible elsewhere, with every exception documented. Its MFA guidance asks organizations to mandate MFA for users and administrators on cloud and internet-connected services.
A yes holds only as far as its weakest account. Remote access into the office, the backup console, the owner’s own mailbox, a shared mailbox and an account a program uses overnight each count, and each one is easy to leave out when MFA is switched on in a hurry before a renewal.
An application answer is a statement your insurer may come back to when a claim arrives. A yes is safest when a dated export of the sign-in settings shows MFA enforced on every account the question covers. Where the honest answer is partial, the application is the place to say so, with the date the rest will be done.
Questions about the policy itself, such as exclusions, conditions or what happens at claim time, belong with your broker or your insurer. The wording differs from one insurer to the next, and only they can say how theirs is read.
MFA is one question among several. Applications also tend to ask about backups kept out of an attacker’s reach and tested by restoring, software updates, staff training and a written incident response plan. The list of questions the Insurance Bureau of Canada says insurers may ask includes when the last security and privacy audit was performed and whether all its recommendations were implemented.
Our answer on insurers’ security questions covers how to respond to the whole form from evidence. The service page below describes the readiness work itself.
When an owner forwards us an application with MFA questions on it, this is the sequence.
You fill in and sign the application; we make sure each answer about sign-in matches what is running. The scope and a fixed price go into a scope letter after a 30-minute conversation.
Leave your name and your number. A person calls you back the same business day, usually within an hour, and goes through the insurer’s sign-in questions with you one at a time.