Cyber insurance questionnaire: how to answer the email security questions

Cyber-insurance renewal questionnaires vary. Some include email-security questions about multi-factor authentication, monitoring, forwarding rules, suspicious sign-ins, logging, payment verification, or incident response. Answer only from controls you actually operate. InboxGuards provides monitoring records for $4 per user per month, but only your carrier can decide whether they are relevant to a requirement.

Wording and requirements vary by carrier, policy, and business. Obtain the actual application; examples may include:

• ■"Is multi-factor authentication (MFA) enforced for all email accounts?" — Answer from the tenant's actual configuration and ask the carrier how it defines enforcement.
• ■"Do you monitor email accounts for unauthorized access or configuration changes?" — Describe the process you actually use and ask your broker how the carrier defines monitoring.
• ■"Would you detect a mail forwarding rule sending copies of email outside your organization?" — External forwarding is a common business-email-compromise technique; answer based on the exact tools and audit events available in your tenant.
• ■"Do you retain logs of sign-in activity?" — Answer from the provider edition, configured retention, and records your organization actually stores.
• ■"Do you have a process for responding to a suspected email compromise?" — Describe your actual written process and confirm the carrier's requested details with your broker.

InboxGuards connects read-only with customer-admin authorization and checks supported audit records at roughly 5-minute intervals for configured account-takeover indicators. These are examples of records it can provide; the carrier decides whether any record is relevant:

• ■Monitoring email accounts → scheduled checks approximately every 5 minutes, with timestamped alerts for configured matches.
• ■Detecting forwarding rules → supported external-forwarding and inbox-rule events are checked when the provider exposes them.
• ■Detecting suspicious sign-ins → supported sign-in records are checked against configured location rules when required fields are available.
• ■Producing evidence → downloadable activity reports and a printable certificate of monitoring, generated from your dashboard.

Be accurate on your application; incorrect statements may affect underwriting or coverage, and only your broker, carrier, or counsel can advise on your policy. InboxGuards is monitoring and alerting software. It is not managed detection and response, does not remediate incidents, and cannot catch every attack. Describe only the controls you actually operate and let the carrier determine what satisfies its requirements.

Setup is self-serve and requires authorization from the customer's Microsoft 365 or Google Workspace administrator. Monitoring begins after a successful connection and scheduled check. Reports describe recorded InboxGuards activity only; ask the carrier before attaching them to an application.