The insurance renewal has security questions nobody here can answer.
The application came from your agent, and a few questions are in a language your office doesn’t speak: whether a second step is required on every email account, when anyone last restored from a backup, how many computers run software that no longer gets updates.
You pay for IT, so it’s fair to assume the answers are on file. Often a piece is, and the rest sits in different places. Your name goes on the answers, so it helps to know where each one comes from.
Where each answer lives
- Second step on email. The list of accounts and sign-in methods in your Microsoft 365 or Google Workspace admin settings. Whoever administers the account can read it out.
- Backups. Two dates: the last successful backup, and the last time anyone restored from one. The second answers the question. NIST’s small business guidance says to protect and test your backups.
- Computers that no longer get updates. A count by Windows version across every computer, including the one in the back room.
- Ways in from outside. The list of remote connections, such as a remote desktop setting or a remote access program, who uses each, and whether each needs a second step.
- People who left. The accounts still enabled, set beside the current staff roster.
Questions to put to your agent
These questions belong with your agent, who knows the form.
- Which of these questions does the insurer treat as required, and which are informational?
- Is “in progress, with a date” an accepted answer, and in what words?
- What security practices does the policy itself call for once it starts, and what are the reporting timelines? The NAIC suggests asking both.
- Who reads the answers, and can you attach a document to them?
Answering with a count and a date
A bare yes or no hides the part that matters. “Second step on email: 23 of 25 accounts, the other two scheduled for November 6” says what is true. Write the number, the date it was checked, and who checked it. (Those figures are an illustration, not a real measurement.)
Keep the evidence beside each number: the screenshot, the message from your provider, the date of the last restore. Put them in one folder with the application, so the person who signs next year can see what this year’s answers stood on.
Where the true answer is “not yet,” write that. If you can change the setting first, change it, then answer; the answer should describe the day you sign.
Words on the form, in plain terms
Applications vary, so use the wording on yours. If a term is unclear, ask your agent what the insurer means by it before you answer.
- Endpoint: each computer, laptop, and server in the business.
- Privileged or administrator account: an account that can install software, change settings, or create other accounts.
- Multi-factor authentication: the second step at sign-in, such as an approval on a phone.
- End of life or unsupported: software the maker no longer provides security updates for. Windows 10 reached that point on October 14, 2025, according to Microsoft.
- Tested restore: someone brought data back from a backup and confirmed it opened, with a date.
Collect the answers in one place
When two people answer the same question from memory, the answers often differ. Pick one person to collect them, write down where each came from, and keep that page with the application. Whoever signs can then see the source of every line. Next year’s renewal starts from this page instead of from nothing.
What a scan can and can’t supply
A scan of the computers can supply the machine rows: Windows versions, update state, and programs found, by computer and by date. It can’t see mailbox settings, how backups are set up, or who holds administrator rights, so it answers only some of the questions. It doesn’t complete the application. Whoever signs decides every answer.
For the answers you’re unsure about, we look with you at what can be checked on each computer and give you a dated count, such as how many computers are on a current Windows version. A person reads the result, and the count covers only the computers examined.
The questions are asking whether someone has looked, and a count with a date shows that someone did.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.