Critical:  Absent these steps cyber insurance coverage is unlikely

1. Identity Access Management – Put the following behind multifactor authentication (MFA):
   • Employee email
   • Remote Access (Virtual Private Network (VPN) and Remote Desktop Protocol (RDP))
   • Privileged Access (Admin accounts)
2. Endpoint Protection – Deploy Endpoint Detection & Response Solution (EDR) on all managed endpoints and servers and place in blocking mode.
3. Backups – Maintain segmented, encrypted, offline or immutable backups of critical data, with separate credentials for access protected by MFA, and test recovery at least annually.
4. Patching and Vulnerability Management – Have a documented plan that addresses:
   • Segmented End of Life (EOL) software and hardware.
   • Regular patching and scanning cadence.
   • Demonstrated ability to apply critical security patches immediately (<48 hours), particularly in response to high profile zero-day exploits.
5. Cybersecurity Awareness and Phishing Training – Train all new employees upon hire and retrain annually for all users. Conduct quarterly phishing campaigns on all users.

Preferred: May help you secure more competitive pricing and coverage

1. Email Filtering – Utilize strong email filtering tools that block malicious attachments, suspicious file types, and executables. Utilize tools that can run suspicious attachments in a isolated environment or sandbox. Employ SPF, DKIM, and DMARC.
2. Privileged Access Management (PAM) – Incorporate privileged access account security measures and/or an integrated PAM tool that actively manages admin accounts and maintains audit logs. Utilize domain/service account restrictions across the environment and separate from day-to-day accounts. Limit the number of service accounts in the DA group (<5). Review vendor access regularly. Turn off local admin control on all owned/managed endpoints or implement compensating controls
3. Segmentation – Segment your network by operational function, data classification, operational risk, and geography. Incorporate safeguards to prevent lateral movement across your network.
4. Security Operations Center (SOC) – Utilize a 24/7 SOC, either internal, third party, or hybrid.
5. Security Monitoring – Invest in a security information and event monitoring (SIEM) tool.
6. Encryption – Encrypt all critical data, in-transit and at rest on servers. Encrypt all end user devices, especially those with critical data.

Desirable: May help you be classified as best-in-class within your risk profile segment.

1. Password Management – Require strong user passwords that must be periodically changed. Provide employees with a password manager.
2. Data Loss Prevention and Intrusion Detection – Invest in a tool that monitors data loss (DLP) and place in blocking mode. Invest in an intrusion detection system (IDS).
3. Data Governance – Have a unified data governance solution to help manage and govern your data.
4. Plans – Have written Disaster Recovery (DRP), Business Continuity (BCP), and Incident Response (IRP) Plans in place and updated yearly. Have a Ransomware Playbook and conduct regular tabletop exercises.
5. Standards – Follow an information security framework (i.e., IS2700, NIST SP 800-53,171, CSF, CIS Controls, HITRUST and COBIT).
6. Vendor Management – Require cyber insurance, ask for indemnification, and enforce minimum security standards.
7. Access Management – Utilize a zero-trust security framework with just-in-time (JIT) access.