Cyber insurance proposal: Fabrikam Dental Group =============================================== Prepared 12 October 2026 by Harbour IT. Microsoft 365 data from 11 Oct 2026. Gaps to close. Fabrikam Dental Group has 4 controls not in place. Controls: 7 Pass, 4 Fail, 5 Partly, 7 Your evidence, 1 Not collected GAPS TO CLOSE Legacy authentication blocked - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users - SMTP AUTH is on for the organisation. - SMTP AUTH is allowed Fix: Block legacy authentication (Exchange ActiveSync and other clients) with a Conditional Access policy for all users. Legacy protocols can't do MFA and are the most common password-spray target. Managed, encrypted and on supported systems - 6 of 54 computers not encrypted. - DESK-MOORE18 (ava.moore@fabrikam.example): Windows disk isn't encrypted - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows disk isn't encrypted - LAPTOP-ROBINSON07 (thomas.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-WARD29 (jack.ward@fabrikam.example): Windows disk isn't encrypted - and 1 more - 9 of 55 managed devices not compliant. - DESK-LEWIS12 (william.lewis@fabrikam.example): Not compliant - DESK-MOORE18 (ava.moore@fabrikam.example): Not compliant - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Not compliant - LAPTOP-DAVIES38 (ruby.davies@fabrikam.example): Not compliant - LAPTOP-LEE25 (arthur.lee@fabrikam.example): Not compliant - and 4 more - 7 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. External sharing restricted - Anyone, including anonymous links. - SharePoint and OneDrive: Anyone links are allowed - 2 files and folders shared with anyone. - holiday.jpg (OneDrive of anna.kowalski@fabrikam.example): Anyone can view - Open day flyer.pdf (Marketing / Documents): Anyone can view, link never expires - Anyone, including guests, can invite guests. - Guests can invite other guests Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. Third-party apps controlled - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. MULTI-FACTOR AUTHENTICATION AND ACCESS (FAIL) MFA for every user, on email and cloud apps Verdict: Pass Requirement: Multi-factor authentication is enforced for all users accessing email (including webmail and mobile) and cloud applications. - Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@fabrikam.example (break-glass). - But: 27 users without MFA. - Users with an MFA method registered: 50.9% of 55 - Accounts covered by an enforced MFA policy: 54 of 54 Text to paste: Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@fabrikam.example (break-glass). What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins only. Add VPNs, remote desktop and other systems. MFA for every administrator Verdict: Pass Requirement: Every privileged and administrator account is protected by MFA. - 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@fabrikam.example (excluded from "Require MFA for all users"). - But: 1 admin without MFA, and 1 whose registration isn't known. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 Text to paste: Multi-factor authentication is enforced for the administrator accounts of Microsoft 365 and Microsoft Entra ID. 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@fabrikam.example (excluded from "Require MFA for all users"). What Microsoft 365 can't show: Judged for Microsoft 365 and Entra ID admin roles. Add administrators of other systems. MFA on remote access Verdict: Your evidence Requirement: VPN, remote desktop and remote support tools need MFA. Text to paste: Remote access to the network is only possible through [VPN or remote access product], which requires multi-factor authentication. Remote support tools ([product]) also require multi-factor authentication. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Legacy authentication blocked Verdict: Fail Requirement: Sign-in protocols that can't use MFA (IMAP, POP, SMTP AUTH, older Office clients) are blocked. - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users - SMTP AUTH is on for the organisation. - SMTP AUTH is allowed Fix: Block legacy authentication (Exchange ActiveSync and other clients) with a Conditional Access policy for all users. Legacy protocols can't do MFA and are the most common password-spray target. Text to paste: Legacy authentication is allowed. No enabled policy blocks legacy sign-in for all users. What Microsoft 365 can't show: Judged from Conditional Access and Exchange Online settings. Separate accounts for administration Verdict: Partly Requirement: Administrators use a separate account for admin work, not the one they read email with. - 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: anna.kowalski@fabrikam.example. Fix: Give each administrator a separate, unlicensed admin account with no mailbox, used only for administration, and take the admin roles off the account they use every day. Text to paste: Most administrator accounts are separate from day-to-day accounts. There are exceptions. 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: anna.kowalski@fabrikam.example. What Microsoft 365 can't show: Judged from Microsoft 365 admin role holders: an admin account with a licence or a mailbox looks like an everyday account. Few, named, internal administrators Verdict: Partly Requirement: Administrator access is limited to a small number of named internal people: no guests, no unnecessary Global Administrators, no apps with admin roles. - 2 Global Administrators. - Cloud-only tenant: no accounts are synced from on-premises AD. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 - 1 guest with admin roles. - g#EXT#@fabrikam.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. Text to paste: Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (anna.kowalski@fabrikam.example, breakglass@fabrikam.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles. What Microsoft 365 can't show: Microsoft 365 shows who holds admin roles today; describe how the list is reviewed. Leavers and inactive accounts removed Verdict: Partly Requirement: Accounts are disabled promptly when people leave, inactive accounts are removed, and no disabled account keeps a licence. - No stale guest invitations. - 7 accounts inactive for 90+ days or never used. - aaron.smith@fabrikam.example: Licensed member, last signed in 22 Apr 2026 - aisha.brown@fabrikam.example: Licensed member, last signed in 6 Mar 2026 - jack.lee@fabrikam.example: Licensed member, last signed in 3 Jun 2026 - noah.wood@fabrikam.example: Licensed member, last signed in 6 Feb 2026 - rhys.walker@fabrikam.example: Licensed member, last signed in 4 Jun 2026 - and 2 more - 1 disabled account still licensed. - ben.okafor@fabrikam.example: Disabled, holding 1 licence Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. Text to paste: Some inactive accounts in Microsoft Entra ID have not been disabled. 7 accounts inactive for 90+ days or never used. 1 disabled account still licensed. What Microsoft 365 can't show: Judged from sign-in activity in Microsoft Entra ID (needs Entra ID P1 for last sign-in dates). Describe the leavers process in the answer. EMAIL SECURITY (PARTLY) Incoming mail filtered Verdict: Pass Requirement: Incoming email is filtered for spam, phishing and malicious links and attachments. - Incoming email for fabrikam.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). Text to paste: Incoming email is filtered for spam, phishing and malware. Incoming email for fabrikam.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). What Microsoft 365 can't show: Microsoft 365 shows which mail gateway the domains route through, not its settings. SPF, DKIM and DMARC on every domain Verdict: Partly Requirement: Every email domain publishes SPF, signs with DKIM and has a DMARC policy. - 1 domain with SPF problems. - parked.example: Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing - 1 mail domain without DKIM. - fabrikam.example: Microsoft 365 DKIM isn't set up (selector2 CNAME missing) - 2 domains without DMARC enforcement. - fabrikam.example: DMARC is monitor-only (p=none); spoofed mail is still delivered - parked.example: Doesn't receive mail but has no DMARC p=reject record Fix: Publish one SPF record per domain ending in -all (or ~all while testing), e.g. "v=spf1 include:spf.protection.outlook.com -all". Domains that never send mail should publish "v=spf1 -all". Text to paste: SPF, DKIM and DMARC are not fully configured for the organisation's email domains. 1 domain with SPF problems. 1 mail domain without DKIM. 2 domains without DMARC enforcement. What Microsoft 365 can't show: Judged from public DNS and Exchange Online for the tenant's domains. No automatic forwarding outside Verdict: Partly Requirement: Automatic forwarding of email to external addresses is blocked, and inbox rules that forward or hide mail are caught. - The default outbound policy blocks automatic external forwarding. - 5 external forwards. - anna.kowalski@fabrikam.example: Mailbox forwarding to anna.kowalski@homemail.example (keeps a copy) - anna.kowalski@fabrikam.example: Inbox rule "Copy to home" forwards to anna.kowalski.home@homemail.example - rhys.hall@fabrikam.example: Mailbox forwarding to rhys.hall@homemail.example (doesn't keep a copy) - rhys.walker@fabrikam.example: Mailbox forwarding to rhys.walker@homemail.example (doesn't keep a copy) - thomas.robinson@fabrikam.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example - 1 suspicious inbox rule. - anna.kowalski@fabrikam.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. Text to paste: Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 5 external forwards found. What Microsoft 365 can't show: Judged from the Exchange Online outbound spam policy, mailbox forwarding and inbox rules. Payment changes verified by phone Verdict: Your evidence Requirement: Requests to change bank details or make payments are verified with a known contact by phone. Text to paste: Requests to change supplier bank details or make urgent payments are verified by calling the requester on a number already held on file, never one given in the request. Payments over [amount] need approval by [role]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. DEVICES AND PATCHING (FAIL) EDR on every computer and server Verdict: Your evidence Requirement: Endpoint detection and response is installed and monitored on all computers and servers. Text to paste: [EDR product, for example Microsoft Defender for Endpoint] is installed on all [number] computers and servers. Alerts are monitored by [team or security provider] [24/7 or in business hours]. What Microsoft 365 can't show: Office Sentry doesn't read Microsoft Defender; answer from the EDR console. Managed, encrypted and on supported systems Verdict: Fail Requirement: Company devices are managed, encrypted and run operating systems that still get security updates. - Computers managed by Intune: 54 - Of which encrypted: 48 - Windows computers out of support: 7 - Reaching end of support within 90 days: 29 - Not compliant: 9 - 6 of 54 computers not encrypted. - DESK-MOORE18 (ava.moore@fabrikam.example): Windows disk isn't encrypted - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows disk isn't encrypted - LAPTOP-ROBINSON07 (thomas.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-WARD29 (jack.ward@fabrikam.example): Windows disk isn't encrypted - and 1 more - 9 of 55 managed devices not compliant. - DESK-LEWIS12 (william.lewis@fabrikam.example): Not compliant - DESK-MOORE18 (ava.moore@fabrikam.example): Not compliant - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Not compliant - LAPTOP-DAVIES38 (ruby.davies@fabrikam.example): Not compliant - LAPTOP-LEE25 (arthur.lee@fabrikam.example): Not compliant - and 4 more - 7 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Text to paste: Managed Windows computers run versions of Windows that no longer receive security updates. 7 of 54 Windows computers past end of support. What Microsoft 365 can't show: Judged for devices known to Intune or Entra ID. Servers, macOS and unmanaged devices aren't seen. Critical updates within 14 days Verdict: Pass (decided by demo) Requirement: Critical security updates are installed within 14 days of release (some forms say 30). - But: 5 devices haven't checked in for 30+ days. Text to paste: Windows updates install through Intune update rings with a 3-day deferral, and Harbour IT checks every Monday that no device is more than 14 days behind. Router and firewall firmware is updated within 14 days of a security release by Harbour IT. What Microsoft 365 can't show: Intune shows when each device last checked in, not when updates were installed. BACKUPS AND RECOVERY (YOUR EVIDENCE) Backups kept separately and tested Verdict: Pass (decided by demo) Requirement: Backups are taken regularly, kept offline or immutable and separate from the main systems, and restores are tested. Text to paste: Microsoft 365 mail, OneDrive, SharePoint and Teams data is backed up daily by Datto SaaS Protection to storage separate from Microsoft 365, kept for 12 months, with credentials separate from the Microsoft 365 administrator accounts. The last restore test was on 2 September 2026. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Continuity and recovery plan Verdict: Your evidence Requirement: A business continuity and disaster recovery plan exists and is tested. Text to paste: A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Incident response plan Verdict: Your evidence Requirement: A documented incident response plan says who does what. Text to paste: A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. MONITORING AND DATA (FAIL) Audit logging on Verdict: Pass Requirement: Audit logging is enabled for email and user activity. - Mailbox auditing is on for the organisation. Text to paste: Mailbox audit logging is enabled in Exchange Online, recording access to and actions on mailboxes. Mailbox auditing is on for the organisation. What Microsoft 365 can't show: Judged from Exchange Online mailbox auditing and the unified audit log. Suspicious sign-ins monitored Verdict: Not collected Requirement: Risky sign-ins and users are detected and acted on. - Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2). - Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2). Text to paste: Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day]. What Microsoft 365 can't show: Judged from Entra ID Protection (needs Entra ID P2 for the full detections). External sharing restricted Verdict: Fail Requirement: Sharing files with people outside the organisation is restricted and guests are invited deliberately. - Anyone, including anonymous links. - SharePoint and OneDrive: Anyone links are allowed - 2 files and folders shared with anyone. - holiday.jpg (OneDrive of anna.kowalski@fabrikam.example): Anyone can view - Open day flyer.pdf (Marketing / Documents): Anyone can view, link never expires - Anyone, including guests, can invite guests. - Guests can invite other guests Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. Text to paste: Sharing with anonymous and external users is not restricted in SharePoint and OneDrive. Anyone, including anonymous links. 2 files and folders shared with anyone. Anyone, including guests, can invite guests. What Microsoft 365 can't show: Judged from SharePoint and OneDrive sharing settings and links. Third-party apps controlled Verdict: Fail Requirement: Users can't consent to third-party apps on their own, and apps with risky permissions are known. - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. Text to paste: Third-party application access to Microsoft 365 data is not controlled. Users can consent to any app. 1 app with access to mail, files or the directory. What Microsoft 365 can't show: Judged from Entra ID consent settings and app permissions. NETWORK AND PEOPLE (YOUR EVIDENCE) Firewalls at the internet boundary Verdict: Pass (decided by demo) Requirement: Firewalls sit between the network and the internet. Text to paste: A WatchGuard Firebox T45 firewall protects the internet connection at the Manchester practice, and the Leeds practice uses the same model. Home and remote workers are protected by the Microsoft Defender Firewall on their company laptops, enforced by Intune. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. No remote desktop open to the internet Verdict: Your evidence Requirement: Remote desktop is closed to the internet, or only reachable through a VPN or gateway with MFA. Text to paste: Remote desktop (RDP) is not reachable from the internet. Remote connections go through [VPN or remote desktop gateway] with multi-factor authentication. This was last confirmed on [date] by [external scan or firewall review]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Security awareness training Verdict: Your evidence Requirement: Staff receive regular security awareness and phishing training. Text to paste: All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. ANSWERS FOR THE FORM: CYBER INSURANCE PROPOSAL Multi-factor authentication and access Is multi-factor authentication (MFA) enforced for all users accessing email, including webmail and mobile? Answer: Yes Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@fabrikam.example (break-glass). Still to check: This covers Microsoft 365 sign-ins only. Add VPN, remote desktop and any other system people reach from outside the office. Is MFA required for all remote access to the network, such as VPN, remote desktop and remote support tools? Answer: Your input Remote access to the network is only possible through [VPN or remote access product], which requires multi-factor authentication. Remote support tools ([product]) also require multi-factor authentication. Based on: Microsoft 365 can't show this. It sees Microsoft 365 sign-ins (see the MFA answer), not VPNs or remote desktop. Is MFA enforced for all privileged and administrator accounts? Answer: Yes Multi-factor authentication is enforced for the administrator accounts of Microsoft 365 and Microsoft Entra ID. 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@fabrikam.example (excluded from "Require MFA for all users"). Still to check: Covers Microsoft 365 and Entra ID admin roles. Add admin access to servers, firewalls, backup consoles and other cloud services. Are legacy authentication protocols that can't use MFA blocked? Answer: No Legacy authentication is allowed. No enabled policy blocks legacy sign-in for all users. Are administrator accounts separate from the accounts people use every day? Answer: Partly Most administrator accounts are separate from day-to-day accounts. There are exceptions. 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: anna.kowalski@fabrikam.example. Still to check: Covers Microsoft 365 admin roles. Add local administrator, server and domain admin accounts. Is administrator access limited to a small number of named people? Answer: Partly Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (anna.kowalski@fabrikam.example, breakglass@fabrikam.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles. Still to check: Add administrators of servers, firewalls and other systems, and say how the list is kept. Are leavers' accounts disabled promptly and inactive accounts removed? Answer: No Some inactive accounts in Microsoft Entra ID have not been disabled. 7 accounts inactive for 90+ days or never used. 1 disabled account still licensed. Still to check: Describe the leavers process: who tells IT, and how quickly accounts are disabled. Email security Is incoming email filtered for spam, phishing and malicious links and attachments? Answer: Yes Incoming email is filtered for spam, phishing and malware. Incoming email for fabrikam.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). Still to check: Office Sentry sees the mail routing and licences, not the filtering policies. Confirm Safe Links and Safe Attachments (or the gateway's equivalent) apply to every user. Are SPF, DKIM and DMARC configured for your email domains? Answer: No SPF, DKIM and DMARC are not fully configured for the organisation's email domains. 1 domain with SPF problems. 1 mail domain without DKIM. 2 domains without DMARC enforcement. Is automatic forwarding of email to external addresses blocked? Answer: Partly Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 5 external forwards found. Do you verify requests to change bank details or make payments by calling a known contact? Answer: Your input Requests to change supplier bank details or make urgent payments are verified by calling the requester on a number already held on file, never one given in the request. Payments over [amount] need approval by [role]. Based on: Microsoft 365 can't show this. It's a finance process. Devices and patching Is endpoint detection and response (EDR) installed and monitored on all computers and servers? Answer: Your input [EDR product, for example Microsoft Defender for Endpoint] is installed on all [number] computers and servers. Alerts are monitored by [team or security provider] [24/7 or in business hours]. Based on: Microsoft 365 can't show this. Office Sentry doesn't read Microsoft Defender for Endpoint or other EDR consoles. Are all operating systems supported and still receiving security updates, with no end-of-life systems? Answer: No Managed Windows computers run versions of Windows that no longer receive security updates. 7 of 54 Windows computers past end of support. Still to check: Covers Windows computers known to Intune or Entra ID. Add servers, macOS, phones, network devices and other software. Are critical security updates installed within 14 days of release? Answer: Yes Windows updates install through Intune update rings with a 3-day deferral, and Harbour IT checks every Monday that no device is more than 14 days behind. Router and firewall firmware is updated within 14 days of a security release by Harbour IT. Answered by demo on 11 Oct 2026 Still to check: Some forms ask about 30 days. Answer to the timescale on the form. Are laptops and desktops encrypted? Answer: No Company computers managed in Microsoft Intune are not all encrypted. 6 of 54 computers not encrypted. Still to check: Covers computers managed by Intune. Add any computers that aren't. Are company devices centrally managed? Answer: No Company devices are not all managed centrally. 1 of 55 joined computers not in Intune. 9 of 55 managed devices not compliant. Still to check: Covers devices joined to Entra ID. Add any company devices that aren't. Backups and recovery Are backups taken regularly, kept offline or immutable, separate from your main systems, and tested? Answer: Yes Microsoft 365 mail, OneDrive, SharePoint and Teams data is backed up daily by Datto SaaS Protection to storage separate from Microsoft 365, kept for 12 months, with credentials separate from the Microsoft 365 administrator accounts. The last restore test was on 2 September 2026. Answered by demo on 11 Oct 2026 Still to check: Add servers and any data held outside Microsoft 365. Do you have a business continuity and disaster recovery plan, and is it tested? Answer: Your input A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date]. Based on: Microsoft 365 can't show this. Do you have a documented incident response plan? Answer: Your input A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date]. Based on: Microsoft 365 can't show this. Monitoring and data Is audit logging enabled for email and user activity? Answer: Yes Mailbox audit logging is enabled in Exchange Online, recording access to and actions on mailboxes. Mailbox auditing is on for the organisation. Still to check: How long audit logs are kept depends on the Microsoft 365 licence; confirm the retention period. Do you monitor for suspicious sign-ins? Answer: Your input Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day]. Based on: Sign-in risk needs Entra ID P2. Is sharing of files with people outside the organisation restricted? Answer: No Sharing with anonymous and external users is not restricted in SharePoint and OneDrive. Anyone, including anonymous links. 2 files and folders shared with anyone. Anyone, including guests, can invite guests. Is access to your data by third-party applications controlled? Answer: No Third-party application access to Microsoft 365 data is not controlled. Users can consent to any app. 1 app with access to mail, files or the directory. Network Do you have firewalls between your network and the internet? Answer: Yes A WatchGuard Firebox T45 firewall protects the internet connection at the Manchester practice, and the Leeds practice uses the same model. Home and remote workers are protected by the Microsoft Defender Firewall on their company laptops, enforced by Intune. Answered by demo on 11 Oct 2026 Is remote desktop (RDP) closed to the internet? Answer: Your input Remote desktop (RDP) is not reachable from the internet. Remote connections go through [VPN or remote desktop gateway] with multi-factor authentication. This was last confirmed on [date] by [external scan or firewall review]. Based on: Microsoft 365 can't show this. It's a firewall setting. People Do staff receive regular security awareness and phishing training? Answer: Your input All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role]. Based on: Training isn't visible in Microsoft 365 data. Answer from the training provider's records. ABOUT THIS EVIDENCE Scope: insurers ask about the whole business, not one cloud service. A Pass here covers Microsoft 365; the answer should say what covers the rest. Most forms are signed as a warranty: a wrong answer can void the policy, so a Partly should be declared, not rounded up. Requirements: UK cyber insurance proposal forms as commonly worded in 2026. Questions drawn from the proposal and renewal forms of UK cyber insurers and brokers, in their typical wording; no insurer's form is copied. Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; nothing was changed. Answers marked [in brackets] still need completing.