Cyber Insurance Readiness Checklist (Manufacturing)

0%

0 of 32 items complete

10 critical items still open - these are the highest-risk gaps.

Download checklist:

Identity and access

MFA is enforced on all email access, including webmail and mobileCRITICALMFA is enforced on all remote access (VPN, remote desktop, VDI, vendor support)CRITICALMFA is enforced on all privileged and administrator accounts, including cloud consolesCRITICALPrivileged accounts are separate from daily-use accountsShared and default accounts are inventoried and restrictedLeavers are disabled within a defined time and access is reviewed at least yearly

Backup and recovery

Backups are kept offline, off-site or immutable, separate from the domainCRITICALRestore tests are performed and recorded at least yearlyCRITICALERP database and plant system backups are included in scopeRecovery time objectives are documented for critical systemsBackup administrator credentials are separate and use MFABackup success and failure is monitored and reviewed

Endpoint, patching and network

EDR or next-generation endpoint protection is deployed on servers and workstationsCRITICALAlerts are monitored 24x7 internally or by a managed serviceCRITICALCritical vulnerabilities on internet-facing systems are patched within a documented periodCRITICALEnd-of-life operating systems are identified and isolated or replacedNetwork segmentation separates the plant floor from the office networkFirewall rules are reviewed at least yearly and external exposure is scannedEmail filtering blocks malicious attachments and links

Policies, people and response

A written incident response plan exists and was reviewed in the last 12 monthsCRITICALA tabletop or incident exercise was held in the last 12 monthsSecurity awareness training and phishing simulations run at least yearlyPayment change and wire transfer requests require call-back verificationAn acceptable use policy and password policy are publishedContact details for the insurer, breach counsel and incident response firm are recorded

Third parties, data and evidence

A list of critical vendors and managed service providers with their access existsVendor remote access is approved, logged and time-limitedSensitive data (customer drawings, personal data, CUI) is located and classifiedPrior incidents and claims in the last 3 to 5 years are documented accuratelyCRITICALAnnual revenue and dependency figures for business interruption limits are preparedEvidence such as screenshots, policies and test records is collected in one folderApplication answers are reviewed by IT, finance and the person who signs

Critical items are the ones underwriters most often treat as conditions of cover or major pricing factors. Treat any unchecked critical item as something to fix before submitting the application. Requirements vary by insurer, so use your broker's actual form as the final authority.

Optional evidence pack help

Ask how private AI over your own policies and records can speed up insurance questionnaires without sending data outside.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Go through each group with your IT lead and finance. Tick what is true and provable today, and mark everything else as an action. Collect evidence while you go, because brokers and underwriters ask for screenshots, policy documents and test records. Start about 90 days before renewal so that you have time to deploy controls such as MFA or EDR rather than only promising them. Export the checklist to share the open items with your broker.

Start 60 to 90 days before renewal
Collect evidence as you tick items
Have finance confirm revenue and downtime figures

Why these controls are asked about

Insurers study claims. The same patterns recur: stolen credentials without MFA on email or remote access, backups that were reachable and destroyed, unpatched internet-facing systems and no monitoring that spots an intruder in time. Manufacturers add specific exposure from production stoppage and flat networks. Controls that reduce those patterns carry the most weight in underwriting, so the critical items cluster there.

Common mistakes

The biggest mistake is answering yes to an application question that is only partly true. A misstatement can put a claim at risk, so answer accurately and describe partial controls as partial. Another is assuming the policy covers the plant floor, ransom payments or business interruption without reading the wording and sub-limits. Ask your broker about waiting periods, sub-limits, war and infrastructure exclusions and required panel vendors.

Do not overstate controls on the application
Read sub-limits and waiting periods
Know your insurer's required incident notice steps
Check coverage of OT and contingent business interruption

Frequently Asked Questions

Which controls matter most to cyber insurers?

MFA on email, remote and privileged access, tested offline or immutable backups, endpoint detection with monitoring, timely patching of exposed systems and a written, exercised incident response plan. Exact thresholds differ by insurer and size.

Does cyber insurance cover plant floor downtime?

It may, but wording varies. Check business interruption triggers, waiting periods, sub-limits and whether OT or non-malicious system failure is covered. Ask your broker to confirm in writing for your specific situation.

Can I get cover without MFA?

It is increasingly difficult. Many insurers treat MFA on email, remote access and admin accounts as a requirement. Without it you may see exclusions, higher retention or a decline. Deploying it before applying is usually cheaper.

How far ahead should we prepare?

Allow 60 to 90 days before renewal. Time is needed to deploy controls, run a restore test, hold a tabletop and gather evidence, all of which underwriters like to see dated and documented.

If you want help turning your gaps into a plan, or generating the evidence pack from your own documents without leaving your network, Netray can discuss it. The checklist is free and requires no contact.

Talk to an Expert Explore More Free Tools

Related Tools

Costing & Finance

More Compliance & Contracts tools

See all

Cyber Insurance Readiness Checklist for Manufacturers