# Cyber Insurance Readiness Checklist for Manufacturers > Source: https://netray.co/tools/cyber-insurance-readiness-checklist-for-manufacturers > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A checklist of the controls and documents underwriters commonly ask manufacturers about, so you can fix gaps before the application or renewal. ## Category compliance-legal ## Industry Discrete Manufacturing ## Audience - IT security lead - CFO - Risk manager ## Tool **Kind:** checklist **Scoring Note:** Critical items are the ones underwriters most often treat as conditions of cover or major pricing factors. Treat any unchecked critical item as something to fix before submitting the application. Requirements vary by insurer, so use your broker's actual form as the final authority. **Groups:** #### Identity and access **Items:** **Text:** MFA is enforced on all email access, including webmail and mobile **Critical:** true **Text:** MFA is enforced on all remote access (VPN, remote desktop, VDI, vendor support) **Critical:** true **Text:** MFA is enforced on all privileged and administrator accounts, including cloud consoles **Critical:** true Privileged accounts are separate from daily-use accounts Shared and default accounts are inventoried and restricted Leavers are disabled within a defined time and access is reviewed at least yearly #### Backup and recovery **Items:** **Text:** Backups are kept offline, off-site or immutable, separate from the domain **Critical:** true **Text:** Restore tests are performed and recorded at least yearly **Critical:** true ERP database and plant system backups are included in scope Recovery time objectives are documented for critical systems Backup administrator credentials are separate and use MFA Backup success and failure is monitored and reviewed #### Endpoint, patching and network **Items:** **Text:** EDR or next-generation endpoint protection is deployed on servers and workstations **Critical:** true **Text:** Alerts are monitored 24x7 internally or by a managed service **Critical:** true **Text:** Critical vulnerabilities on internet-facing systems are patched within a documented period **Critical:** true End-of-life operating systems are identified and isolated or replaced Network segmentation separates the plant floor from the office network Firewall rules are reviewed at least yearly and external exposure is scanned Email filtering blocks malicious attachments and links #### Policies, people and response **Items:** **Text:** A written incident response plan exists and was reviewed in the last 12 months **Critical:** true A tabletop or incident exercise was held in the last 12 months Security awareness training and phishing simulations run at least yearly Payment change and wire transfer requests require call-back verification An acceptable use policy and password policy are published Contact details for the insurer, breach counsel and incident response firm are recorded #### Third parties, data and evidence **Items:** A list of critical vendors and managed service providers with their access exists Vendor remote access is approved, logged and time-limited Sensitive data (customer drawings, personal data, CUI) is located and classified **Text:** Prior incidents and claims in the last 3 to 5 years are documented accurately **Critical:** true Annual revenue and dependency figures for business interruption limits are prepared Evidence such as screenshots, policies and test records is collected in one folder Application answers are reviewed by IT, finance and the person who signs ## Content **Intro:** Cyber insurance applications have become detailed security questionnaires, and manufacturers with weak controls face higher premiums, exclusions or declined cover. This checklist helps you see what is likely to be asked and close gaps before you apply or renew. **Sections:** #### How to use the checklist **Body:** Go through each group with your IT lead and finance. Tick what is true and provable today, and mark everything else as an action. Collect evidence while you go, because brokers and underwriters ask for screenshots, policy documents and test records. Start about 90 days before renewal so that you have time to deploy controls such as MFA or EDR rather than only promising them. Export the checklist to share the open items with your broker. **Bullets:** - Start 60 to 90 days before renewal - Collect evidence as you tick items - Have finance confirm revenue and downtime figures #### Why these controls are asked about **Body:** Insurers study claims. The same patterns recur: stolen credentials without MFA on email or remote access, backups that were reachable and destroyed, unpatched internet-facing systems and no monitoring that spots an intruder in time. Manufacturers add specific exposure from production stoppage and flat networks. Controls that reduce those patterns carry the most weight in underwriting, so the critical items cluster there. #### Common mistakes **Body:** The biggest mistake is answering yes to an application question that is only partly true. A misstatement can put a claim at risk, so answer accurately and describe partial controls as partial. Another is assuming the policy covers the plant floor, ransom payments or business interruption without reading the wording and sub-limits. Ask your broker about waiting periods, sub-limits, war and infrastructure exclusions and required panel vendors. **Bullets:** - Do not overstate controls on the application - Read sub-limits and waiting periods - Know your insurer's required incident notice steps - Check coverage of OT and contingent business interruption **Cta:** If you want help turning your gaps into a plan, or generating the evidence pack from your own documents without leaving your network, Netray can discuss it. The checklist is free and requires no contact. **Faq:** #### Which controls matter most to cyber insurers? **Answer:** MFA on email, remote and privileged access, tested offline or immutable backups, endpoint detection with monitoring, timely patching of exposed systems and a written, exercised incident response plan. Exact thresholds differ by insurer and size. #### Does cyber insurance cover plant floor downtime? **Answer:** It may, but wording varies. Check business interruption triggers, waiting periods, sub-limits and whether OT or non-malicious system failure is covered. Ask your broker to confirm in writing for your specific situation. #### Can I get cover without MFA? **Answer:** It is increasingly difficult. Many insurers treat MFA on email, remote access and admin accounts as a requirement. Without it you may see exclusions, higher retention or a decline. Deploying it before applying is usually cheaper. #### How far ahead should we prepare? **Answer:** Allow 60 to 90 days before renewal. Time is needed to deploy controls, run a restore test, hold a tabletop and gather evidence, all of which underwriters like to see dated and documented. ## Search terms cyber insurance readiness checklist, cyber insurance requirements checklist, cyber insurance application questions, cyber insurance underwriting controls, cyber liability insurance manufacturing, cyber insurance renewal checklist, get cyber insurance MFA backups --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json