Insurance and compliance handoff questions

Overview

Cyber insurers and ISO/ SOC customers ask detailed questions. Capture answers during onboarding, not 48h before renewal.

Question themes

• MFA coverage %, privileged access controls, EDR coverage, patch SLAs, backup immutability, IR retainer, last tabletop date.
• Subprocessors (your stack) and data locations.

Artifacts

Existing policies, past pen test reports, vendor SOC2 summaries, BAA templates.

Gaps

If unknown, log as risk register item with remediation ETA—better than fabrication.

Privacy

Store questionnaires in restricted Teams channel; redact unrelated client names from sample evidences.

Annual refresh

Calendar ping 90 days pre-renewal with diff questionnaire—track deltas since prior year.

Legal

MSP does not sign client insurance attestation as guarantor unless E&O reviewed—language matters.

Upsell

Gaps map neatly to vCISO hours or MDR attach—keep recommendations tied to their questionnaire wording.