What if only some of our accounts have MFA?

Say so. Answer "partly", list which accounts are covered and which are not, and say when the rest will be done. A scoped, accurate answer is safer than a broad "yes" that does not hold up.

Is Microsoft Defender or antivirus the same as EDR?

Not necessarily. Antivirus blocks known threats; EDR records activity and supports investigation and response. Some products offer both, depending on the licence and settings. Check what is actually switched on and answer for that.

What counts as evidence for a backup?

Dated proof that backups run and that a restore works: the job log, a record of a restore test, and a note of where copies are held and who can delete them.

Can oowl fill in the questionnaire for us?

We can help you gather the facts and evidence. You, as the person insured, are the one who signs and answers, and oowl cannot promise cover or a claim outcome.

How often should we re-check our answers?

At every renewal, and whenever you change email, backup or security tools or add systems.

Cyber insurance questionnaire: answering MFA, backup, EDR and patching truthfully

In short: Answer from what you can show, not from what you assume or were told. For each question, find out exactly where the control is and is not in place, write the answer to match, and keep dated evidence such as a screenshot or report. If the honest answer is "partly", say so and describe the scope, because an inaccurate answer can affect a claim.

Last checked 12 Nov 2026 against the sources listed below. By oowl. General information for Australian small businesses, not legal advice or advice for any particular organisation. Related service: oowl shield monitoring.

Why accuracy matters more than a good-looking answer

For business insurance, the Insurance Contracts Act 1984 (section 21) puts a duty of disclosure on the person buying cover: to tell the insurer what they know, or a reasonable person would know, is relevant to the insurer's decision on whether and on what terms to insure. A confident "yes" that turns out to be wrong can affect whether, and how much, the insurer pays. Questionnaires and policy wordings vary, so use this page for the thinking and ask your broker or a lawyer how it applies to your policy.

Multi-factor authentication (MFA)

Pin down the question. "Do you use MFA?" usually means: for which accounts, and is it enforced or optional? Check email, remote access (VPN or remote desktop), admin accounts, cloud and backup consoles, accounting and banking. Count an account as protected only if a sign-in cannot succeed without the second factor.

Be honest about the type. ASD's Essential Eight maturity model expects MFA for staff signing in to online services that process, store or communicate sensitive data, and for customers of services holding their sensitive data. Text-message codes are weaker than authenticator apps or passkeys; if that is what you use, say so.

Evidence to keep: a dated screenshot or export of the enforcement policy (for Microsoft 365, the conditional access or security defaults setting), and a user list showing each person's MFA status.

Backups

Pin down the question. Insurers usually want to know what is backed up, how often, whether a copy is kept where ransomware cannot reach or change it, and whether you have tested a restore. "We have backups" and "we have restored from them" are different answers. The Essential Eight's Maturity Level 1 asks for backups of data, applications and settings that are retained securely, tested by restoring, and cannot be modified or deleted by ordinary user accounts. ASD's small business handbook says to back up regularly and test that you can restore.

Evidence to keep: the backup job schedule and last-success log, a note of where copies are held and who can delete them, and a dated record of your last restore test and what you restored.

EDR (endpoint detection and response)

Pin down the question. EDR is more than antivirus: it records what happens on a device and lets someone investigate and contain an attack. Do not answer "yes" because antivirus is installed. Find out which product runs on each computer and server, whether it is the EDR tier, and whether anyone watches its alerts. The Essential Eight itself does not include an EDR requirement, so insurers set their own.

Evidence to keep: the console's device list showing which machines are covered and in what state, plus who receives and responds to alerts. Report coverage as a count (for example, "22 of 25 computers"), not a round "yes". Our oowl shield monitoring page describes how we approach monitoring for small businesses.

Patching

Pin down the question. Questions often ask how quickly you apply critical patches. Answer with what happens in practice. For reference, Maturity Level 1 asks for patches to internet-facing services within 48 hours when a flaw is rated critical or is being exploited, and within two weeks otherwise, and for office software, browsers, email clients and PDF software within two weeks. Include network devices such as firewalls and routers, which people forget.

Evidence to keep: a patch report or the update settings and recent history from your management tool, and a list of anything unsupported that you still run.

A short routine before you sign

Get the questionnaire and read each question as a lawyer would, noting words like "all", "enforced" and "regularly".
Ask whoever runs your IT to show you each control, not just tell you.
Write down any gap and how you will close it, with a date.
Keep a copy of the answers you gave and the evidence, dated, with the policy.
Re-check at renewal, and whenever you change email, backup or security tools.

Also see how the Essential Eight and ASD Essentials relate to these controls. If a fake invoice or payment request is a worry, our free email spoofing check is a quick first look at your domain. oowl does not sell insurance and cannot promise that any answer, control or evidence will lead to cover or a paid claim.

Sources

oowl writes each guide in its own words from these public sources and rechecks them before changing the date above. Guidance changes, so check the sources for the latest detail. Related guides: Essential Eight and the new ASD Essentials: where should a small business start?; The first 30 days after a data breach under the NDB scheme. All guides: oowl guides.

Cyber insurance questionnaire: how to answer the MFA, backup, EDR and patching questions