All free tools
Free tool

Can you answer yes to a cyber insurer's security questions?

Answer 17 questions from Chubb's Irish proposal forms yes, no or not sure. See which you can answer yes, what each form asks for, and the guides on this site to closing the gaps.

What was answered

Sign-in

Does every mailbox need two-step sign-in, a code or an app prompt as well as the password?
01Does every mailbox need two-step sign-in, a code or an app prompt as well as the password? Not answered

Does every mailbox need two-step sign-in, a code or an app prompt as well as the password?

Webmail and cloud email such as Microsoft 365 or Google Workspace. Chubb's glossary says a VPN, an IP or MAC address, a shared secret key, a monthly re-authentication or VOIP authentication is not a second factor.

Is two-step sign-in required on every other way in from outside, for staff, contractors and suppliers alike?
02Is two-step sign-in required on every other way in from outside, for staff, contractors and suppliers alike? Not answered

Is two-step sign-in required on every other way in from outside, for staff, contractors and suppliers alike?

Remote desktop, a VPN, and the cloud apps the business runs on, such as accounts or a CRM. If email is the only way in, answer yes.

Does anyone who runs your systems use a separate admin account, with its own sign-in, for that work?
03Does anyone who runs your systems use a separate admin account, with its own sign-in, for that work? Not answered

Does anyone who runs your systems use a separate admin account, with its own sign-in, for that work?

An admin account kept apart from the account the same person uses for everyday email and browsing.

Backups

Is at least one copy of your backups out of reach of your everyday systems and logins?
04Is at least one copy of your backups out of reach of your everyday systems and logins? Not answered

Is at least one copy of your backups out of reach of your everyday systems and logins?

Kept offline, stored so that it cannot be changed once written (immutable), or reached only through a separate account with two-step sign-in.

Have you restored data from a backup in the last 12 months, checked what came back, and kept the date and the result?
05Have you restored data from a backup in the last 12 months, checked what came back, and kept the date and the result? Not answered

Have you restored data from a backup in the last 12 months, checked what came back, and kept the date and the result?

A file brought back from a recycle bin tests the recycle bin. The test is a restore from the backup itself.

Devices and updates

Does every laptop, desktop and server run endpoint detection and response (EDR), or the extended or managed kind (XDR or MDR)?
06Does every laptop, desktop and server run endpoint detection and response (EDR), or the extended or managed kind (XDR or MDR)? Not answered

Does every laptop, desktop and server run endpoint detection and response (EDR), or the extended or managed kind (XDR or MDR)?

Chubb's glossary describes EDR as recording what happens on each device, detecting suspicious behaviour and blocking malicious activity.

Do you have a set process for installing security updates, with a target number of days to fix each level of severity?
07Do you have a set process for installing security updates, with a target number of days to fix each level of severity? Not answered

Do you have a set process for installing security updates, with a target number of days to fix each level of severity?

Severity as the Common Vulnerability Scoring System grades it: low, medium, high and critical.

Is every device and program you use still supported by its maker, with nothing past its end of life?
08Is every device and program you use still supported by its maker, with nothing past its end of life? Not answered

Is every device and program you use still supported by its maker, with nothing past its end of life?

An old Windows version, a server or a router that no longer gets security updates counts as unsupported.

Do you keep a list of all your hardware and software, kept up to date?
09Do you keep a list of all your hardware and software, kept up to date? Not answered

Do you keep a list of all your hardware and software, kept up to date?

Every laptop, phone and server, and the programs and online services the business uses.

Email

Are SPF and DKIM set up and enforced for your email domain?
10Are SPF and DKIM set up and enforced for your email domain? Not answered

Are SPF and DKIM set up and enforced for your email domain?

SPF lists the servers allowed to send email as your domain, and DKIM signs what they send. The free email security check reads both from public DNS.

Is suspicious email quarantined automatically, with attachments and links tested in a sandbox before they reach anybody?
11Is suspicious email quarantined automatically, with attachments and links tested in a sandbox before they reach anybody? Not answered

Is suspicious email quarantined automatically, with attachments and links tested in a sandbox before they reach anybody?

A sandbox opens an attachment or a link somewhere separate first, to see what it does.

Are Microsoft Office macros switched off by default on documents?
12Are Microsoft Office macros switched off by default on documents? Not answered

Are Microsoft Office macros switched off by default on documents?

Macros are the small programs a Word or Excel file can carry. If the business does not use Microsoft Office, answer yes and say so in the form's commentary box.

People and plans

Has everyone had phishing training or a phishing simulation in the last 12 months?
13Has everyone had phishing training or a phishing simulation in the last 12 months? Not answered

Has everyone had phishing training or a phishing simulation in the last 12 months?

A session on spotting phishing, or a test email sent to staff to see who clicks.

Do you have a written plan for a cyber incident or a data breach, tested in the last 12 months?
14Do you have a written plan for a cyber incident or a data breach, tested in the last 12 months? Not answered

Do you have a written plan for a cyber incident or a data breach, tested in the last 12 months?

Who decides, who calls the insurer, who tells the Data Protection Commission, and a practice run of it.

Is one person named as responsible for data and network security, with contact details you can put on the form?
15Is one person named as responsible for data and network security, with contact details you can put on the form? Not answered

Is one person named as responsible for data and network security, with contact details you can put on the form?

The forms ask for the contact details of the chief information security officer, or of the staff member responsible.

Privacy and card payments

Have you checked in the last 12 months that the business meets the GDPR and the other privacy rules that apply to it?
16Have you checked in the last 12 months that the business meets the GDPR and the other privacy rules that apply to it? Not answered

Have you checked in the last 12 months that the business meets the GDPR and the other privacy rules that apply to it?

A review of what personal data you hold, why, who it goes to and how long you keep it, written down and dated.

If you take card payments, do you meet the level of the card industry's security standard (PCI DSS) that applies to you?
17If you take card payments, do you meet the level of the card industry's security standard (PCI DSS) that applies to you? Not answered

If you take card payments, do you meet the level of the card industry's security standard (PCI DSS) that applies to you?

PCI DSS is the Payment Card Industry Data Security Standard. Answer yes if you take no card payments.

0 of 17 answered.

Free, no account, and nothing you type leaves your browser.

How it works

The questions come from the three proposal forms Chubb publishes on its Irish page for its Cyber Enterprise Risk Management policy: the short form (ROI0268-MD 09/22), the standard form (ROI0270-MD 09/22) and the extensive form (ROI0269-MD 09/22), each read in full on 29 October 2026. Each question here is one control those forms ask about, worded so that yes means it is in place, and the result names the form and the question it comes from.

The short form says that filling it in binds neither Chubb nor you, and that further information, including a full proposal form, may be required. Where the short form does not ask about a control, the result names the form that does.

What the forms ask in full, what the Consumer Insurance Contracts Act 2019 says about answering them, and how to keep the proof are in what a cyber insurer asks an Irish small business. What meeting cyber insurance requirements costs prices the work.

There is no score. The forms do not say how an insurer weighs an answer, so the result says nothing about whether cover will be offered or what it will cost.

What it cannot tell you

  • It is built on Chubb's three Irish forms. Another insurer's form can ask other questions, or the same ones in other words, so answer the form your broker sends.
  • It leaves out the questions about the business itself, which the forms also ask: turnover, revenue from the United States and Canada, sanctions, how many people's data you hold, and past incidents.
  • None of Chubb's forms asks how a change to a supplier's bank details is checked, so neither does this. What stops invoice redirection covers that control.
  • A yes here is your own answer, not evidence. The evidence is what you keep, dated, from the systems themselves: an export, a screenshot, a restore log.
  • It reads nothing from outside. The free email security check reads your SPF, DKIM and DMARC records from public DNS.

Sources

  1. 1.Cyber Enterprise Risk Management, Ireland: proposal forms · Chubb European Group SE
  2. 2.Chubb Cyber Enterprise Risk Management short proposal form, Ireland (ROI0268-MD 09/22) · Chubb European Group SE
  3. 3.Chubb Cyber Enterprise Risk Management standard proposal form, Ireland (ROI0270-MD 09/22) · Chubb European Group SE
  4. 4.Chubb Cyber Enterprise Risk Management extensive proposal form, Ireland (ROI0269-MD 09/22) · Chubb European Group SE

Read next

Close the basics, and show the proof

Protect sets up and proves the basics among these: two-step sign-in on every staff account, backups kept separately with a dated test restore, an incident plan practised once, and SPF with DMARC set to enforce. A second scan and an evidence pack show the work to your insurer. Device protection and patching stay with your IT provider. From €2,950 up to 10 staff, fixed before we start.

See Protect

All the free tools and checks