The cyber insurance questionnaire a Hawaii law firm gets at renewal asks about seven things: MFA, EDR, backup, email filtering, training, incident response and privileged access. The acronyms make it look like an IT form. It is not. It is a set of promises the firm is making, in writing, about how it operates, and the answers become part of the contract.
Here is what each question means for a five to thirty person firm, and what a yes requires you to be doing.
The rule for the whole form: answer what is true today, not what you intend to be true by spring. A no with a plan next to it costs a little more premium. A yes that turns out to be a mostly gives a carrier a reason to examine a claim closely, at the exact moment you need the policy to work.
Multi factor authentication on email and remote access
This is the question that moves the price most, and the word doing the work is enforced. Available is not enforced. Turned on for most people is not enforced. A policy that exempts two partners who found it irritating is not enforced, and those accounts are the ones worth stealing.
What a yes requires: a policy that applies to every account including administrators and partners, a count of exemptions that is zero or close to it with a written reason for each, and coverage of every door into the firm rather than email alone. Remote access, the document system if it is reachable from outside, and the accounting platform. Go and look at the exemption list. Most firms have one, most have not read it since the day it was created, and that is where the real answer to this question lives.
Endpoint detection and response, monitored
Carriers learned to separate the software from the watching, so expect two questions in one. Detection software on the machines, and a human who reads what it produces.
What a yes requires: the agent installed on every machine including the laptop the founding partner takes home, someone named who reviews alerts, and a response time you can state. Ask your provider what happens when an alert fires at 11pm on a Saturday. If the answer is that it appears in a queue for Monday, that is a fine answer to give the carrier, but give it accurately rather than describing it as monitored.
Tested backups, kept off the network
Three claims hiding in one question, and ransomware is the reason for all three. Attackers look for the backup system first and delete it with credentials they already hold, so the question is whether a copy exists that a compromised account cannot reach, and whether anyone has proved it restores.
What a yes requires: a restore performed on purpose, with a date you can name and a note of how long it took. At least one copy that everyday firm credentials cannot delete, which usually means separate credentials and storage that will not accept deletion for a set period. And coverage of the systems that matter, meaning the document repository, email and the accounting platform, not the file server alone.
The honest answer to "are backups tested" is usually no. Most firms verify that backups ran. Restoring something deliberately to see what comes back is a different activity, and far fewer firms do it. If you fix one thing before this renewal, make it this one. It is inexpensive and it is also the thing that saves the practice in a real incident.
Email filtering, and the payment change rule
Business email compromise is where the money goes, and carriers know it. The question has a technical half and a human half.
What a yes requires: filtering in front of the mailbox, external senders marked so a spoofed partner name is visible as outside mail, and your domain's sending records configured so someone else cannot send mail as your firm. Then the human half, which matters more for a law firm than for almost any other business: a written rule that any change to wire or trust account instructions is verified by telephone, on a number taken from the file rather than from the message asking for the change. Write it down, give it to whoever handles disbursements, and say out loud that nobody is ever in trouble for making the call.
Security awareness training
Carriers ask because trained staff report suspicious mail, and reporting is what turns an incident into a near miss.
What a yes requires: training on a schedule rather than once at hire, simulated phishing that produces a number you can show, and a reporting route people know how to use. For a firm of this size the useful measure is not the click rate. It is how quickly the first person reports, because that is the number that decides whether you contain it.
An incident response plan
The question is whether a plan exists. The follow-up question, which some carriers now ask, is whether anyone has read it.
What a yes requires: one page that says who declares an incident, who calls the carrier and within what window, who calls outside counsel, who talks to staff and to clients, and where the phone numbers live when the network is unavailable. Print it. A plan stored only in the document system is unavailable in precisely the incident it was written for.
Privileged access
The last question is who holds administrative rights, and it is the one small firms answer worst, because the honest answer is often that everyone does.
What a yes requires: daily work done from a standard account, administrative rights on separate accounts used only when needed, a current list of who holds them including your IT provider's staff, and a review on a schedule. Local administrator rights on attorney laptops should be the exception, since that is what turns one bad attachment into an encrypted firm.
Do these before you fill in the form
- Count your MFA exemptions. Count them, do not estimate.
- Restore something this week and write down the date.
- Confirm one backup copy cannot be deleted with everyday credentials.
- Put the wire and trust verification rule on one page and hand it out.
- List everyone with administrative rights, your provider included.
- Print the incident contact sheet and put it somewhere that is not the network.
Keep the evidence for whatever you answer: a dated export, a screenshot, the restore result. If a claim is ever examined, "we said yes, and here is what we had at the time" is a far better position than a recollection.
Common questions
What does a cyber insurance questionnaire ask a law firm?
Multi factor authentication on email and remote access, endpoint detection that someone monitors, backups that are tested and kept off the network, email filtering, security awareness training, an incident response plan, and how privileged accounts are controlled.
Does MFA on email count if the partners are exempt?
No. The word on the form is enforced, and an exemption list is the opposite of enforced. Count your exemptions before you answer, because the exempt accounts are usually the ones an attacker wants.
What makes a backup count as tested and off the network?
Someone restored real data from it on a date you can name, and at least one copy cannot be deleted using everyday firm credentials. Ransomware operators delete backups with the access they already have, which is what the question is about.
What happens if we answer yes and it turns out to be mostly yes?
The questionnaire is a representation that becomes part of the contract. A no with a remediation plan costs a little more premium. A yes that does not hold up gives the carrier a reason to look harder at a claim.
Send us the questionnaire before you fill it in
We will tell you which answers your firm can honestly give today, which need a fix first, and roughly what each fix takes. It is usually a short conversation.
Get the questionnaire reviewedEmail info@enlightentechhi.com, call 808-451-3630, or book a time before your renewal. The wider version of this guide is what your cyber insurance renewal will ask, and the firm-wide picture is in IT for law firms in Honolulu.
Practical guidance, not legal or insurance advice. Your broker and your policy wording govern what is covered.