Multi-factor authentication (MFA)
Also called: 2FA, two-factor authentication, two-step verification
In one sentence
A second step at sign-in beyond your password (an app prompt, code, or security key), so a stolen password alone can't get in.
MFA requires a second proof of identity when you log in: a tap on a phone app, a one-time code, or a physical security key. Because attackers usually have only your password (from a leak or a phishing page), that second factor stops the vast majority of account takeovers.
Why it's on your cyber insurance application
The single most-required control on cyber applications. Carriers ask whether MFA is enforced on email, remote access, and admin accounts. A 'no' is the most common reason a small business is declined.
What this looks like in practice
In Microsoft 365 or Google Workspace you turn this on for everyone at once, not person by person. What people miss is the shared mailbox the whole front desk signs into and the one executive who asked to be excepted. An underwriter reads "enforced, with two exceptions" very differently from "enforced", so close the exceptions before you answer.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
MFA & identity
Is multi-factor authentication (MFA) required on all business email accounts?
Why carriers ask: Stolen credentials are the most common way attackers get in. Nearly every carrier now requires MFA on email, remote access, and admin accounts as a condition of coverage.
If the answer is no: Enable enforced MFA in Microsoft 365 / Google Workspace today. Built-in, free, typically an afternoon including user comms.
MFA & identity
Is MFA required for remote access (VPN, remote desktop) and administrator accounts?
Why carriers ask: Stolen credentials are the most common way attackers get in. Nearly every carrier now requires MFA on email, remote access, and admin accounts as a condition of coverage.
If the answer is no: Inventory every remote entry point (VPN, RDP, remote-support tools) and privileged account; enforce MFA on each or shut it off.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, those documents are:
- Password & Multi-Factor Authentication Policy (preview its opening sections)
- Training One-Pager: Passwords & MFA
Guides that cover this
What MFA do cyber insurance carriers actually require?
Carriers require enforced MFA on email, remote access and admin accounts. What enforced means, how to set it up free, and how to answer accurately.
Cybersecurity 101: the basic precautions insurers actually notice
A plain-English guide to the cybersecurity basics that move the needle on a cyber insurance application, and which of them you can fix in an afternoon.
Why cyber insurance claims get denied
Cyber claims get denied for inaccurate answers, unmaintained controls, late notice and exclusions. What investigations check, and how to stay covered.
Where this comes up by trade
Some trades get asked about this harder than others, usually because a rule or a claim pattern already points at it. These pages have that detail.
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.