What does a cyber insurance form mean by MFA on all remote access?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you require Multi-Factor Authentication (MFA) for remote access to your network (both cloud-hosted and on-premises, including via Virtual Private Networks (VPNs))?

Is MFA implemented and enforced to secure all remote access to your network for all employees and third parties on all applications, including VPNs (Virtual Private Network), RDP (Remote Desktop Protocol), RDWeb (Remote Desktop Web) and any RMM (Remote Management and Monitoring) applications?

Multi-factor authentication for remote access to the Applicant's network and other systems and programs that contain private or sensitive data in bulk

Enabling two-factor authentication (2FA) or Multifactor authentication (MFA) enabled on all remote access and emails?

Please confirm whether multi-factor authentication is required for all remote access to your network:

What does it mean for a small firm?

Remote access is any way to reach your office systems from somewhere else: a VPN, remote desktop, a web portal, or the remote support tool an outside provider uses to look after your computers.

MFA means a second step after the password, such as a code from an app or a security key. One form names VPN, RDP, RDWeb and remote management tools, and asks about third parties as well as staff.

How do I answer it truthfully?

List every way in from outside, including the tools outside support companies use. For each one, check that every account is asked for a second step. If one is not, the true answer is No.

Read the note on the form. One says that a Yes is a statement that MFA is on before the policy starts and stays on for the whole policy period.

By selecting "Yes" to the Multi-Factor Authentication (MFA) question, you represent that MFA is implemented and enforced prior to the inception of the proposed policy and will remain continuously implemented and enforced for the duration of the policy period.

What can an outside reading show, and what can it not?

An outside reading can see whether a remote desktop port, a file sharing port, or a VPN or other remote-access login page answers from the internet on your domain and its host names.

It cannot see whether that login asks for a second step. Only the settings of each system can show that.

Which questions sit next to this one?

• Remote access allowed
• VPN login pages
• MFA on email
• MFA on admin accounts