What does a cyber insurance form mean by MFA on backups?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

MFA is implemented and enforced to access all backup data.

Two-factor authentication (2FA) or Multifactor authentication (MFA) settings are enabled for access to file back-ups?

Please provide details on how you secure your backups (e.g., backups are disconnected and inaccessible from the live environment, multi-factor authentication is required for access to cloud backups, etc.):

What does it mean for a small firm?

Backups only help if whoever gets into your network cannot also delete them. A second step on the backup account is one way the forms ask about that.

How do I answer it truthfully?

Find where each backup is kept: a cloud service, a drive at the office, a provider's system. For each, check whether the account that manages it asks for a second step.

Can an outside reading check this?

An outside reading cannot see your backups or how they are reached. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• Offline and immutable backups
• Backup frequency
• Backup testing and restore time