What does a cyber insurance form mean by MFA on cloud systems that hold sensitive data?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Please confirm whether multi-factor authentication is required to access all cloud resources holding sensitive or confidential information:

Multi-factor authentication for remote access to the Applicant's network and other systems and programs that contain private or sensitive data in bulk

What does it mean for a small firm?

Sensitive information is anything about clients or staff you would have to report if it were taken. Cloud services are reached from anywhere, so every one of them counts.

How do I answer it truthfully?

List the cloud services that hold that information. Check the sign-in setting of each one. Answer Yes only if every account on every one of them needs the second step.

What can an outside reading show, and what can it not?

An outside reading can see which addresses at your domain are listed in breach data from other services. A listed address is one whose password may be known to strangers. A second step is what stops a known password from being enough.

It cannot see your cloud services or their sign-in settings.

Which questions sit next to this one?

• MFA on email
• Counting records
• Encryption