That box can matter more than any other line you sign. If a carrier later decides the answer wasn’t true, the problem may not be a smaller payout. It can be the policy itself.
I spent nine years auditing security programs at American Express, Deloitte and Morgan Stanley, and the gap between “we have it” and “it’s actually on everywhere” was one of the most common things I found. This note is about that gap and why it matters when you sign an application. It is not legal or coverage advice. For what your policy says and what your application commits you to, talk to a licensed insurance agent or a lawyer.
For the questions the application asks in general, start with Cyber Insurance Applications Now Ask About MFA, Backups, and Incident Response.
One real case: Travelers v. International Control Services
The case most people point to is from 2022. Travelers sued its policyholder, International Control Services (ICS), an electronics manufacturing services company in Decatur, Illinois, in federal court in the Central District of Illinois (Insurance Journal, July 2022).
According to that reporting and the insurer’s filing, here’s what happened:
- ICS applied for a Travelers cyber policy that took effect April 4, 2022. The application, signed by the company’s CEO, said it used MFA, including for administrative or privileged access.
- In May 2022, about a month after the policy took effect, ICS suffered a ransomware attack.
- During the investigation, Travelers said it learned that ICS used MFA only to protect its firewall, not its server or other digital assets.
- Travelers asked the court to rescind the policy, arguing it would not have issued the policy had it known.
In August 2022 the two sides agreed, and the court entered an order rescinding the policy and declaring it “null and void from its inception,” with no coverage for past, present or future claims (court order, via CourtListener; Insurance Journal, August 2022).
Two things are worth noticing. First, ICS did have MFA. It just wasn’t on the systems the application asked about. Second, the outcome wasn’t a reduced payment. The policy was treated as if it had never existed. The broker Lockton’s write-up of the case explains the general idea: an insurer can seek to rescind a policy if it learns the applicant misrepresented material facts, and a rescinded policy “ceases to exist for all purposes” (Lockton).
That was one case, resolved by an agreed order, and every policy and state is different. I’m not predicting what would happen to you. I’m pointing at the mechanism, because it’s the part owners don’t expect.
Why “we have MFA” is so often the wrong answer
In my audit work, the honest answer to “do you use MFA?” was rarely a simple yes or no. It was usually “on some things, for some people.” The usual gaps look like this:
It’s available, not enforced
MFA is switched on as an option, and most people turned it on. A few didn’t, often the owner, a long-time employee, or someone who complained about the extra step. Available is not the same as required.
It covers email, not the rest
Email has MFA. The remote access tool your IT provider uses, the accounting system, the backup console, or the server doesn’t. The ICS case turned on exactly this kind of gap.
Admin and shared accounts are exempt
The administrator login, the shared office inbox, or the “service” account that “can’t” use MFA. These are often the accounts that matter most to an attacker.
Someone else answered for you
The application asks about systems your outside IT company runs. Someone at your company checked “yes” based on a conversation months ago. Nobody verified it against the actual settings.
How to check your answer before you sign
You don’t need to be technical to do this. You need a list and someone who can show you the settings.
- List every way into your systems. Email, remote access (VPN, remote desktop, remote support tools), cloud apps that hold client or financial data, admin accounts, and backups.
- Ask your IT provider to show you, not tell you. For each item, ask whether MFA is required for every user and how they know. A screenshot of the setting is better than a verbal yes.
- Look for exceptions. Ask specifically about the owner’s account, shared inboxes, admin logins and anything set up years ago.
- Write down what’s true today. If something isn’t covered, the honest answer is not a clean “yes.” Note the gap and when it will be fixed.
- Read the exact wording. “Do you use MFA?” and “Is MFA required for all remote access and privileged accounts?” are different questions. Answer the one on the page.
- Take gaps to your agent before you sign. A licensed agent can tell you how to handle a partial answer with that carrier. That’s their job, and it’s a far better conversation before binding than after a claim.
If you can close a gap before the application goes in, close it. Turning on enforcement for a handful of accounts is often a small job for your IT provider.
If you already signed
If you’re reading this after the policy is bound and you’re not sure your answers were accurate, don’t panic and don’t guess. Find out what’s actually true first, using the steps above. Then talk to your agent, and to a lawyer if you’re concerned, about what to do with what you found. Fixing the gap itself is worth doing right away either way.
When it makes sense to bring someone in
A second set of eyes is worth it when the renewal is close and you can’t answer the controls questions from evidence, when your IT provider can’t show you the settings, or when a contract also depends on the same answers. The work starts from the application in front of you. When the honest read is that most answers would be guesses, the first engagement is a security maturity assessment, $3,000 to $8,000, scored against NIST CSF 2.0 with the gaps ranked, so you sign from evidence instead of from memory.
Start with the free assessment, then book a call with me.