SAMPLE-INS-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Cyber Insurance Readiness Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Common cyber insurance controls for one fictional company of 75 staff, from evidence supplied by the administrator.
Executive summary
Several controls insurers often ask about are supported, but four gaps stand out: MFA is missing on one remote access path, backups have no offline copy and no restore test, endpoint protection covers most but not all devices, and no incident response plan has been exercised.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | MFA status export | Email and remote access | Provided |
| E-02 | Backup job and restore test report | Servers and Microsoft 365 | Provided |
| E-03 | Endpoint protection coverage report | All devices | Provided |
| E-04 | Patch compliance report | Windows servers and workstations | Provided |
| E-05 | Incident response document | 1 document | Provided |
| E-06 | Administrator list | All privileged accounts | Provided |
What was not checked
- Insurer-specific wording
- Policy terms and exclusions
- Physical security
- Staff training records
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | MFA not enforced on the remote access gateway for 12 accounts | E-01 | Enforce MFA and remove unused accounts. |
| F-02 | High | No offline or immutable backup copy and no restore test in 12 months | E-02 | Add an offline or immutable copy and record a restore test. |
| F-03 | Medium | Endpoint protection on 78% of devices | E-03 | Onboard the remaining devices or document exceptions. |
| F-04 | Medium | Incident response plan exists but has never been exercised and has no contact list | E-05 | Add contacts and run a short tabletop exercise. |
| F-05 | Medium | 4 servers are past vendor support | E-04 | Plan replacement or isolation and record the decision. |
| F-06 | Low | 3 shared administrator accounts | E-06 | Replace with named accounts. |
Fix first
- Enforce MFA on remote access Effort: Low.
- Add an offline copy and record a restore test Effort: Medium.
- Close the endpoint protection gap Effort: Low.
- Add contacts to the incident plan and exercise it Effort: Low.
- Plan for the 4 unsupported servers Effort: High.
30/60/90-day plan
- First 30 days: Enforce VPN MFA; replace shared admin accounts; add contacts to the incident plan.
- By 60 days: Add the offline backup copy and restore test; close the endpoint gap.
- By 90 days: Run a tabletop exercise; decide on the unsupported servers; refresh the evidence pack before renewal.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.