Cyber Insurance Providers are changing their underwriting criteria to accurately calculate the risk of paying out on policies.  Like any insurance, financial compensation alleviates the pain of the event but is not a substitute for never experiencing it.  Through working with Insurance Underwriters, ESX has outlined a list of what can be considered standard cyber security controls to qualify for the lowest premium possible.  Lacking these controls puts you at risk of paying a higher premium or even the potential denial of coverage or a policy renewal.

Cyber Security Controls Checklist:

• Multi-Factor Authentication (MFA) for:
  • Email accounts
  • Remote Access to Network (Including RDP Connections/VPN connections)
  • Administrative Access (on-site and remote)
  • Access To All Cloud Services
  • Third-Party Remote Access
• Next-Generation Firewalls (NGFW)
• Next-Generation Anti-Virus (NGAV) and Endpoint Detection & Response Tool (EDR) for all Endpoints (workstations & Servers)
• Employee Training
  • Annual security-awareness training for all employees
  • Phishing Campaigns
• Data Backup Procedures & Policies
  • Daily Backups of Data with a retention Policy
  • Offline/Air-Gapped from Network
  • Tested backups for data integrity, ability to restore, and scanned for malware
  • Encrypted Backups in-flight and at-rest
• Patching Policy
  • Critical & sever patches installed in a timely manner
  • Zero-Day threat patches installed immediately
  • Scheduled Patching for updates, and security loopholes
• RDP controls and restricted access
• Restricted Administrative Rights and credentials
• End of Life (EOL) Software
  • Removed or Segregated from Network
  • Scheduled decommission plan
• Business Continuity Planning
  • Documented Written Plans That Address Outages with Annual Review
    • Business Continuity Plan with:
      • Recovery Time Objective (RTO) & Recovery Point-in-Time Objective (RPO)
    • Disaster Recovery Plan
    • Incident Response Plan
  • Operational Technology (OT) on sperate network – necessary for industries with physical operations relying on OT i.e. manufacturing, transportation, utilities, etc.
  • Email Filtering and Validation
    • Sender Policy Framework (SPF)
    • Domain Keys Identified Mail (DKIM)
    • Domain Message Authentication Reporting & Conformance (DMARC)
  • Password Management Tool
  • Security Information and Event Management (SIEM)
  • Security Operations Center (SOC) – 24/7

All of the above controls are subject to change as cyber security continues to evolve.  A multitude of factors go into insurance underwriting and there are no guarantees, however, having these controls in place greatly increases your own cyber security and should put your company in a position to achieve the lowest premium possible