Why does a cyber insurance form ask whether staff have admin rights on their computers?

What exactly does the form ask?

These are the form's own words, with the page they come from.

Do non-IT users have local administrator rights on their laptops/desktops?

What does it mean for a small firm?

An administrator can install anything, and so can harmful software that runs under that account.

How do I answer it truthfully?

Check the accounts on each computer. In a small firm the first user of a new laptop is often its administrator; if so, the true answer is Yes.

Can an outside reading check this?

An outside reading cannot see accounts on your computers. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• MFA on admin accounts
• Hardened baseline