Applying for cyber insurance, renewing a policy, or filling in the IT security section that professional liability insurers now increasingly include? The questions are technical: multi-factor authentication, backups, endpoint protection, patching, administrator accounts, email security, incident response. Cyber Insurance Express helps you prepare each answer from what is actually configured in your Microsoft 365 tenant, and tells you plainly which questions Microsoft 365 cannot answer.
The security questionnaire has become a central part of buying or renewing cyber cover, and it is rarely easy to answer accurately.
Is multi-factor authentication enforced for every remote access and every administrator? Are backups kept offline or immutable, and has a restore been tested? Do all endpoints run a detection and response tool? Is legacy email authentication switched off? A business owner, a finance director or even a busy IT generalist rarely has these answers to hand, with proof.
The questionnaire forms part of how the insurer understands the risk it accepts. An answer that turns out to be inaccurate can become a point of discussion with the insurer, especially after an incident. The exact consequences depend on your contract and the law that governs it: check them with your broker or insurer. What you control is the accuracy of what you declare.
Verifying conditional access policies, admin role assignments, mailbox protocols, DNS records for email authentication, device compliance and audit logging one by one, question by question, is hours of work in several admin portals. In a small or mid-sized company, that work competes with everything else the IT team must do.
New application, annual renewal, change of broker or insurer, tender from a large customer asking about your cover: the same questions return, often worded differently. Without a structured evidence file, each round starts from scratch and earlier work is lost.
Every insurer writes its own questionnaire, and wording changes from one form and one year to the next. The themes below are the ones that come up frequently. They are described here as recurring themes, not as a quotation of any particular insurer's form.
For each theme, we explain what the question is usually trying to establish, what your Microsoft 365 tenant can show as evidence, and what lies outside Microsoft 365 and has to be documented another way. Links point to Microsoft's own public documentation of the feature concerned.
What is usually asked: is MFA required for email, for remote access, for cloud applications and for every administrator account, with or without exceptions?
What Microsoft 365 can show: whether security defaults are enabled or which Conditional Access policies require MFA, who they apply to and who is excluded; the authentication methods users have registered; whether legacy authentication protocols, which cannot carry MFA, are blocked.
Outside M365: a VPN, a remote desktop gateway or a business application that does not sign in through Microsoft Entra ID must be documented separately.
What is usually asked: are critical systems and data backed up, is at least one copy isolated from the network or protected against modification, how often, and when was a restore last tested?
What Microsoft 365 can show: little that answers this question. Retention settings in Microsoft 365 are not a backup isolated from your own administrator accounts, and we will not present them as one.
Outside M365: your backup solution, the isolation of its copies and your restore test reports. The guided workshop asks you to describe them and attach your own evidence, and the document labels this answer as declared, not measured.
What is usually asked: are all workstations and servers protected by an endpoint detection and response tool, is it monitored, and are devices encrypted?
What Microsoft 365 can show: when devices are managed with Microsoft Intune and protected with Microsoft Defender, the device inventory, compliance policy results (for example encryption and minimum OS version) and the security recommendations reported in Microsoft Secure Score.
Outside M365: a third-party EDR, unmanaged devices and on-premises servers not enrolled in Microsoft tools. They are flagged, not guessed.
What is usually asked: how quickly are security updates applied, are unsupported operating systems still in use, and are critical vulnerabilities on internet-facing systems tracked?
What Microsoft 365 can show: for devices managed with Intune, compliance rules on minimum operating system versions and which devices fail them; where licensed, Defender recommendations.
Outside M365: network equipment, firewalls, line-of-business servers and applications, and your patching procedure itself. The workshop helps you describe it in plain language.
What is usually asked: how many people hold administrator rights, do administrators use separate accounts for daily work, is MFA required for them, and is privileged access time-limited or approved?
What Microsoft 365 can show: who holds which Microsoft Entra administrator role, whether assignments are permanent or eligible through Privileged Identity Management (where licensed), and whether MFA applies to those roles.
Outside M365: local administrator accounts on servers and workstations, domain administrators in an on-premises Active Directory, and admin access to third-party systems.
What is usually asked: are SPF, DKIM and DMARC in place, are phishing and malicious attachments filtered, are legacy mailbox protocols disabled, and is automatic forwarding to outside addresses controlled?
What can be shown: the published SPF and DMARC records of your domains (public DNS data), DKIM signing configuration, Exchange Online and Defender for Office 365 protection policies, and the protocols allowed on mailboxes.
Outside M365: a third-party email gateway placed in front of Microsoft 365, and user awareness training, which you document yourself.
What is usually asked: is there a written incident response plan, who is called first, has it been exercised, and are security logs kept long enough to investigate?
What Microsoft 365 can show: whether the unified audit log is active and searchable, and the retention that applies to it. Microsoft documents that Audit (Standard) is enabled by default for organisations with the appropriate subscription and keeps records for 180 days.
Outside M365: the plan itself. The workshop produces a first draft of a short response plan, including, for organisations in France, the reflex of filing a complaint within 72 hours (see below).
Questionnaires also often ask about the number of employees and records held, previous incidents, the use of service providers with access to your systems, data encryption and security training. Some of these are facts only you can declare. Others, such as external sharing settings or guest accounts in Microsoft 365, can be measured.
Microsoft Secure Score itself states that it is not an absolute measure of how likely you are to be breached. We use measured settings as evidence for specific answers, never as a guarantee.
Where each answer comes from, and how it will be labelled in your document.
| Theme | Where the evidence comes from | Label in your document |
|---|---|---|
| MFA | Microsoft Entra ID: security defaults, Conditional Access policies, registered authentication methods, legacy authentication status | Measured, with exceptions listed by name of policy or group |
| Backups | Your backup tool and restore test reports | Declared by you, with your attachments |
| Endpoint protection | Intune and Defender, when used; otherwise your EDR console | Measured for managed devices; declared for the rest |
| Patching | Intune compliance results; your procedure for servers and network equipment | Partly measured, partly declared |
| Privileged accounts | Microsoft Entra role assignments, Privileged Identity Management where licensed | Measured for Microsoft 365; declared for on-premises |
| Email security | Public DNS (SPF, DMARC), DKIM configuration, Exchange Online and Defender for Office 365 policies | Measured |
| Incident response and logs | Unified audit log status; your written plan | Logs measured; plan drafted in the workshop, validated by you |
Plain rule: nothing in the document is presented as measured unless it was measured. A question that Microsoft 365 cannot answer stays visibly marked as such, so that you, and not a tool, decide what to declare to your insurer.
A self-service path in four steps. You stay in control from the first question to the final document.
A short online test: are you applying for cyber cover, renewing it, or answering the IT security section of a professional liability or other policy? Is your company located in France, where the 72-hour complaint rule applies? Which parts of your IT run on Microsoft 365? The result tells you which themes apply to you and what you will need to gather.
An online workshop walks you through each theme. You answer freely, at your own pace, with explanations of what each question means and why insurers ask it. Where Microsoft 365 can provide evidence, the measured result is placed next to your answer, so any gap between what you believe and what is configured becomes visible before you declare anything.
You receive a structured document in your company's name: answers theme by theme, the evidence attached to each, out-of-scope points flagged, and a first draft of an incident response sheet. It is a working basis, to be reviewed and validated by your own adviser, broker or counsel before it is used.
If you want a second pair of eyes, a partner consultant can review the document with you, help close gaps before renewal, or help document the points that sit outside Microsoft 365. This step is optional; the first three steps are designed to be completed on your own.
Important: the document is a working basis and does not constitute legal advice. It does not replace the questionnaire of your insurer, which you complete and sign yourself, and it does not commit any insurer to cover you. The accuracy of your final declaration remains your responsibility.
One evidence file, honest about what was measured and what was not, that you can reuse at each renewal.
A clear answer for each recurring theme, ready to carry over into your insurer's own form.
The settings that support each answer, as found in your tenant at the date of measurement.
Where your answer and the measured configuration disagree, it shows up here first.
A short first draft to complete with your own contacts and validate internally.
Every legal or regulatory statement in the document points to its official source.
Next year, measure again and compare instead of starting over.
Two minutes to separate what is a legal rule from what is good practice, with the official source each time.
Since 24 April 2023, Article L12-10-1 of the French Insurance Code makes any insurance payment compensating losses and damage caused by an attack on an automated data processing system conditional on the victim filing a complaint with the competent authorities no later than 72 hours after becoming aware of the attack. The clock starts when you become aware of the attack, not when it began.
The article was created by Article 5 of Law No. 2023-22 of 24 January 2023 (known as LOPMI). It does not oblige anyone to buy cyber insurance: it sets a condition for being paid when a contract already covers cyberattacks.
A Ministry of the Interior information sheet distributed through Cybermalveillance.gouv.fr, the French government platform for cyber victims, reminds professional victims that the 2023 law requires them to file a complaint to preserve their right to compensation under their insurance contract, within 72 hours after becoming aware of the attack. It also lists activating the insurance compensation process among the reasons to file a complaint.
The European Union Agency for Cybersecurity (ENISA) published "Cyber Insurance - Models and methods and the use of AI" on 21 February 2024. Its stated aim is to introduce cyber risk and cyber insurance, give an overview of existing research and modelling approaches, and identify gaps for future research. It is useful background on why insurers try to assess the security posture of the companies they cover.
For entities within its scope, Article 21 of Directive (EU) 2022/2555 (NIS2) lists cybersecurity risk-management measures that include incident handling, business continuity such as backup management and disaster recovery, basic cyber hygiene and training, access control, and the use of multi-factor authentication. Even outside NIS2, the overlap with insurers' themes means the evidence you gather for one serves the other.
ANSSI, the French national cybersecurity agency, and AMRAE, the French association of risk and insurance managers, published a guide for executives, "Controlling the digital risk - the trust advantage", available in English and French. It presents digital risk management as a step-by-step approach for organisations of all sizes, which is exactly the frame in which an insurer's questionnaire should be read.
Article 32 of the GDPR requires appropriate technical and organisational measures, including, where appropriate, the ability to restore the availability of personal data in a timely manner after an incident and a process for regularly testing and evaluating the effectiveness of those measures. Backups, restore tests and access control therefore matter well beyond your insurance file.
Outside France: the 72-hour complaint rule above is French law. Other countries have their own rules on insurance and on reporting cybercrime, and your contract may set its own notification deadlines. Check them with your broker, your insurer or your legal adviser. This page is information, not legal advice.
What each option contains. Availability and terms will be published when the service opens.
You are applying for cyber cover, or answering an IT security section for the first time.
The questionnaire comes back with your renewal and your IT has changed since last year.
A new form, worded differently, but asking about the same controls.
Short answers, with the official source where a rule is involved.
Consulted on 13 October 2026. Where a text is in French, the translation on this page is ours and unofficial.
Microsoft, Microsoft 365, Microsoft Entra, Intune, Defender and Purview are trademarks of Microsoft. They are cited only to name the features from which evidence is read. SYAGA Consulting is not affiliated with Microsoft, with ENISA, with ANSSI or with any insurer.
The self-service path is being prepared. Questions in the meantime: contact@syaga.eu
A working basis, not legal advice. The final declaration to your insurer, and its accuracy, remain your responsibility.