Cyber Insurance Requirements - MFA on all administrative logins

I think most applications already do that - at least from the major cyber insurers. But I don't think we're likely to see standardization on applications any more than we will on IT environment design. Everyone has their own data and priorities and market. There is no one-size-fits-all. Insurance brokers have recognized the problem, though, and rolled out their own applications. Just one problem: they're almost uniformly the worst applications on the market. In insurance, one of the reasons your claim can get denied is what's called a "material misrepresentation." Generally if you answer something wrong on the application, and it doesn't have any impact on your claim or how the underwriter assessed the risk, it's not a problem; your claim will still get paid. But if the answer is wrong *and* it impacts the loss, then you might get your claim denied. Brokers know this, and try to stack the deck in your favor by writing vague questions that are wide-open to interpretation, knowing that they *might* be able to get an underwriter to accept them. Of course, your average cyber insurance broker knows as much about IT and security as a kid one week into an A+ certification course, so the questions aren't just vague; they're often bordering on incoherent. Alternatively, there are a couple of broker applications that work out like a mini audit. They're hundreds of questions long, take ages to complete, and are really more about measuring your compliance with NIST or ISO 27XXX than focusing on what's actually relevant in cyber risk. Applications are tough. What we're trying to measure is, essentially, risk variation from a baseline. But there's no real independent standard of what that baseline is, and everyone's trying to figure it out.