The insurance evidence folder

Carriers ask the same eight questions every year — and a claims adjuster will ask for proof. Build this folder once, keep it current, and questionnaires stop being a scramble. Companion to the Cyber-Insurance Readiness Guide.

Setup: create a folder named insurance-evidence/ with one subfolder per control below. Date every file (2026-07-mfa-policy.png). Refresh screenshots at renewal time.

1. MFA on email (the pass/fail item)

• Screenshot: MFA enforcement policy in the Google Workspace / Microsoft 365 admin console
• Screenshot: user list showing every account enrolled
• Date enforced + who verified it

2. MFA on admin accounts & remote access

• Screenshot per platform: admin account security settings showing MFA on
• If no VPN/servers: one line stating "no remote-access infrastructure" (a legitimate answer)

3. Password manager / unique passwords

• Screenshot: member list in the password manager admin view
• One line: which plan, since when

4. Backups — maintained, separated, tested

• Screenshot: backup service status/dashboard showing last successful backup
• Dated note of your last restore test: what you restored, how long it took, result
• One line: what is backed up (laptops? cloud data?) and where it lives

5. Endpoint protection

• Screenshot per device type: Defender/XProtect status or your endpoint product’s console
• One line: auto-update policy for OS and browsers

6. Security-awareness training

• The dated agenda of your last training session (even a 30-minute all-hands counts if documented)
• The one-pager you handed out

7. Departed-employee access removal

• Your written offboarding checklist (generate one with our free tool)
• Audit-log entries from the most recent departure showing access was removed

8. Incident-response plan & contacts

• The one-page contact sheet: who to call (IT help, broker/carrier hotline, bank), who decides, where the backups are
• Note: check your policy’s notice requirements — many carriers require calling them first

The honesty rule

Applications are legal documents; misstatements are the classic reason claims get denied. An accurate “no — planned for Q4” is safer than an optimistic “yes.” This template is educational, not insurance or legal advice — when a question is ambiguous, ask your broker exactly what the carrier means.