How do I answer the cyber insurance question about filtering incoming email?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

What security controls do you have in place for incoming email?

Screening for malicious attachments

Filtering all incoming emails and communications for malicious links, spam, malware and attachments?

If yes, please state the name of the vendor and product used for email filtering:

What does it mean for a small firm?

Every mail service filters some spam. The forms ask about more than that: links and attachments checked before a person opens them, and mail from outside marked as such.

How do I answer it truthfully?

Open your mail service's admin console and read which protections are switched on for links, attachments and external mail. Tick only those. If a separate filtering service receives your mail first, name it.

What can an outside reading show, and what can it not?

Your MX records are public. They show which service receives your mail, and whether it passes through a separate filtering service first.

It cannot see which protections are switched on or how they are set.

Which questions sit next to this one?

• Advanced email protection
• DMARC
• MFA on email