Answering the MFA Section of a Cyber Insurance Application

The MFA section of a cyber insurance application asks you to state, under signature, where multi-factor authentication is enforced. The accurate answer starts with an inventory: workforce accounts, administrators, email, remote access, cloud consoles, backup consoles, vendor and MSP access, and privileged service access. For a company of 10 to 150 people, that inventory takes an afternoon. Answer from that evidence, write down every exception, and let your broker confirm how the specific carrier reads each question.

Why the MFA cyber insurance application answer matters

The signed application is not a survey. At-Bay's June 2026 application (form AB-CYB-APP 06/2026) says the application "is incorporated into and is part of the Policy" and that any misrepresentation "shall be grounds for the rescission of any Policy issued." Travelers' MFA supplement asks an executive officer to attest that answers are true and complete after reasonable inquiry.

The best-known example is Travelers v. International Control Services. In July 2022, Insurance Journal reported that Travelers asked a federal court to declare a policy void after a ransomware attack, alleging the company "only used MFA to protect its firewall" despite an application answer that MFA covered administrative or privileged access. In August 2022 the two sides stipulated that the policy was null and void from inception and the case was dismissed. That was an agreed outcome, not a contested court ruling, but it shows what an overstated answer can cost.

What does the MFA section of an application usually ask?

There is no single question set. The wording differs by carrier, form and year, so read your form line by line rather than assuming it matches another carrier's.

Two published examples show the range. At-Bay's 06/2026 form asks whether MFA is "enforced on all email access" and "enforced on all remote access including VPN or other remote network access." The Travelers MFA supplement (form CYB-14306, revision 03-23, in a copy hosted by an association website) goes further. Beyond email and remote access for employees, contractors and third-party service providers, it lists admin access to directory services, network backup environments, network infrastructure such as firewalls and switches, and endpoints and servers. Each "No" needs an explanation. Confirm with your broker which edition applies to you.

Build the inventory before you answer

Work from a list of systems, not from memory. For each row, record the system, who logs in, whether MFA is enforced or only available, the method, and any exceptions.

• Workforce accounts: every user in your identity provider (Microsoft Entra ID, Google Workspace, Okta or similar). Note shared mailboxes and accounts that can still sign in.
• Administrators: global and tenant admins, domain admins, local admin accounts on servers, firewall and switch admins.
• Email: web access, mobile apps, and any legacy protocols (IMAP, POP, SMTP AUTH) that bypass MFA if left enabled.
• Remote access: VPN, remote desktop gateways, remote support tools, and any server exposed for remote login.
• Cloud consoles: Microsoft 365 and Azure admin centers, AWS, Google Cloud, your domain registrar and DNS host.
• Backup consoles: the backup software and any cloud backup portal. Attackers who reach these can delete your recovery point.
• Vendors and MSPs: RMM tools, remote support accounts, and any vendor account in your tenant.
• Privileged service access: service accounts and API keys that cannot use interactive MFA. List them separately with the compensating control (restricted sign-in, IP limits, vaulted credentials, rotation).

MFA coverage, MFA method and phishing resistance

These are three different facts, and an application may ask about one, two or all three.

Coverage is where MFA is enforced: which systems and which accounts. Method is how the second factor works: SMS or voice code, authenticator app code, push approval, push with number matching, hardware key, or passkey. Phishing resistance is a property of some methods only. NIST SP 800-63B-4 (final, July 2025) says phishing resistance "requires single- or multi-factor cryptographic authentication," and methods that involve manually typing an authenticator output do not qualify. CISA's 2022 fact sheet names FIDO/WebAuthn as "the only widely available phishing-resistant authentication," with PKI-based smart cards as a less common option.

Answer each fact separately. "Yes, MFA on email" is a coverage answer. It says nothing about whether staff can be phished through an app code.

Do SMS codes count as MFA on an insurance application?

SMS can be a second factor, but it is not phishing-resistant, and whether it satisfies a particular carrier's question depends on that carrier's wording and underwriting. Never assume a method will be accepted.

The Travelers supplement uses a text-message code as its own example of "something you have." CISA's phishing-resistant MFA fact sheet says SMS or voice MFA "should only be used as a last resort." NIST SP 800-63B-4 classifies the public telephone network for out-of-band authentication as a restricted authenticator. If any accounts still use SMS, say so plainly, state your plan and date to move them, and ask your broker whether the form's wording treats SMS as compliant.

Why administrators need explicit evidence

Privileged accounts are where an incorrect MFA answer does the most damage, and several forms ask about them by name. An administrator account without MFA gives an attacker the ability to disable the other controls you just attested to.

Collect evidence per admin account, not per policy. A conditional access policy that requires MFA "for all users" may exclude a break-glass account, a directory sync account or a legacy admin. Export the policy, the list of exclusions, and the role assignments, then reconcile them. If an admin can sign in to a firewall or hypervisor with only a local password, the honest answer to an admin-access question is no, or yes with a listed exception.

Document exclusions, dates and resets

Underwriters can follow a precise answer with exceptions. They cannot do anything useful with a vague yes. Keep these records with the application:

• Exclusions: each account or system without enforced MFA, the reason, the compensating control, and the target date.
• Rollout dates: when enforcement started for each system. If enforcement is planned, give the date and do not answer as if it is done.
• Enforcement settings: screenshots or exports showing MFA is required, not just registered. "Available" and "enforced" are different answers.
• Break-glass accounts: how many exist, how the credentials are stored, whether they have a hardware key, and how sign-ins are alerted.
• Reset process: how the help desk verifies a person before resetting MFA. An MFA reset by phone call with no identity check undermines the control.
• Evidence dates: capture date and who captured it, so you can show the state at signing.

If anything changes before the policy starts, tell the broker. At-Bay's form requires the applicant to notify the insurer of changes before inception.

How do you fill in an MFA answer worksheet?

Write one line per question on the form, then record the honest answer, the scope, the exceptions and where the evidence is filed. Have the signer review it before they sign.

Sample worksheet for a 10 to 150 person company:

1. Form question (copy the exact wording): for example, "MFA enforced on all email access?"
2. Systems in scope: Microsoft 365 Exchange Online, all 84 licensed users.
3. Enforced or available: enforced by conditional access since 2026-03-01.
4. Method: authenticator app with number matching for staff; FIDO2 keys for the four admins; SMS for two field staff until 2026-12-15.
5. Exceptions: one break-glass account (hardware key, vaulted, sign-in alert); SMTP AUTH enabled for one scanner, restricted by IP.
6. Answer you will give: yes, with the exceptions listed in an attached note, or the form's comment field.
7. Evidence file: policy export, exclusion list, admin role report, screenshots, dated and initialed.
8. Owner and review date: IT lead, reviewed by the signer.

Repeat for remote access, admin access, backups, cloud consoles and vendors. The same inventory supports the EDR question on a cyber insurance application, and if your renewal also asks about AI tools, see what to prepare for AI questions at renewal.

What this does not promise

Accurate MFA answers support an honest application. They do not guarantee eligibility, a discount, a limit or claim payment, and nothing here is legal advice. Coverage depends on the policy wording and the carrier's decisions. Ask your broker or counsel about how a particular answer will be read.

Sources

• At-Bay Cyber Insurance Application, AB-CYB-APP 06/2026
• Travelers MFA supplement, CYB-14306 Rev. 03-23 (association-hosted copy)
• CISA: Implementing Phishing-Resistant MFA (October 2022)
• CISA: Implementing Number Matching in MFA Applications (October 2022)
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication
• Insurance Journal: Travelers asks court to rescind ICS policy (July 2022)
• Insurance Journal: Travelers and ICS agree policy is void (August 2022)