What does a cyber insurance form mean by MFA on email?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you require MFA for access to web-based email?

Can your users access email through a web application or a non-corporate device?

Multi-factor authentication for remote access to email

Please confirm that multi-factor authentication is enabled for remote access to all company email accounts:

What does it mean for a small firm?

Web email is any mailbox you can open in a browser. For most small firms that is every mailbox, because the mail service is in the cloud.

The forms ask about every account. A shared inbox such as info@ or accounts@ counts too.

How do I answer it truthfully?

Open the admin console of your mail service and look at the sign-in settings for every user. Count the mailboxes that can sign in with a password alone. If the count is not zero, the true answer is No.

What can an outside reading show, and what can it not?

Your MX records are public. They show which service receives your mail, and whether it passes through a separate filtering service first. That tells you which admin console holds the answer.

An outside reading can see which addresses at your domain are listed in breach data from other services. A listed address is one whose password may be known to strangers.

It cannot see whether a mailbox asks for a second step.

Which questions sit next to this one?

• MFA on remote access
• Passwords and leavers
• Email filtering