# Cyber Insurance Readiness Review — Illustrative Renewal ## 1. Review Scope and Inputs Fictional firm Meadow Services Ltd; illustrative four-question renewal checklist provided in the request. No insurer name, form version, full IT inventory, deadline, policy wording or independent testing provided. Evidence descriptions below are user-provided; the documents themselves were not inspected. Treat all dates as illustrative. ## 2. Executive Readiness Summary No item is confirmed in full from primary system evidence. Q01 has one dated screenshot but does not establish workforce coverage. Q02 explicitly shows a four-device coverage gap (38 of 42). Q03 has successful backup jobs but no restore test. Q04 has a plan without exercise proof. Do not submit affirmative blanket answers without confirming coverage and the insurer's definitions. ## 3. Questionnaire-to-Evidence Register | Q ID | Illustrative question | Reported evidence | Status | Priority | Key gap | |---|---|---|---|---|---| | Q01 | Is MFA enforced for privileged access? | Admin MFA screenshot, 6 August | PARTIAL | High | Privileged population and exceptions not reconciled | | Q02 | Are all endpoints protected by managed security tooling? | 38 of 42 devices listed | PARTIAL | High | Four devices not evidenced, monitoring status unknown | | Q03 | Are backups restored and tested? | Successful backup-job report | ASSERTED ONLY for testing | High | No successful restoration result | | Q04 | Is incident response tested? | Written incident plan | ASSERTED ONLY for exercise | Medium | No exercise attendance, scenario or lessons log | The insurer's exact definitions are not supplied; all questions are paraphrased from the hypothetical scenario, not represented as actual insurer language. ## 4. Control-Domain Findings Identity: identify all privileged human/service identities and demonstrate enforcement plus exceptions. Endpoint: reconcile device inventory to active policy deployment; do not treat installed agents as active monitoring without logs. Backups: capture restore scope, success criteria, actual restoration outcome and test date. Response: schedule a scenario exercise and retain actions, attendees and follow-up; the written plan is not an exercise. ## 5. Evidence Register | ID | Evidence item | Custodian (proposed) | Limitation | |---|---|---|---| | E01 | Admin MFA screenshot, 6 August | IT lead | Unknown population covered | | E02 | 42-device list, 38 marked covered | IT lead | No status corroboration for 4 devices | | E03 | Backup job summary | Infrastructure lead | No restoration evidence | | E04 | Incident response plan | Security lead | No testing evidence | ## 6. Prioritized Remediation Plan | Priority | Task | Owner role (proposed) | Acceptance and closure evidence | |---|---|---|---| | High | Reconcile every privileged identity to enforced MFA and document approved exceptions | Identity administrator | Dated list, policy configuration, exception review | | High | Investigate and protect four uncovered devices, confirm monitoring | Endpoint lead | Reconciled inventory and agent check-in proof | | High | Conduct a representative restoration test | Backup lead | Dated test scope, restored artifact, result and reviewer | | Medium | Exercise an incident scenario and track lessons | Security lead | Exercise log, participants, decisions and actions | ## 7. Broker / Insurer Clarifications Ask what 'all endpoints' includes; whether privileged MFA is sufficient or wider MFA is requested; what restore-test recency and scope qualify; and whether a tabletop incident exercise meets the form definition. Record actual responses rather than assuming answers. ## 8. Follow-up and Sign-off Assign named owners, confirm renewal deadline, obtain primary extracts, reconcile devices and identities, validate fixes and have an authorised signatory review every declaration before submission. No application approval is given here. ## 9. Disclaimer Illustrative operational preparation only. Not security certification, insurer acceptance, binding coverage interpretation or legal advice. Seek qualified security and broker/insurer review where required.