How do I answer the cyber insurance questions about penetration testing and security assessments?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Annual penetration testing

Annual network security assessments

If Yes, are such assessments conducted by a third party service provider?

How often do you conduct penetration testing of your network architecture?

What does it mean for a small firm?

A penetration test is an authorised attempt to break in. A security assessment is a review of how exposed you are. The forms ask about them separately.

How do I answer it truthfully?

Answer the penetration test question with tests that tried to break in. If you had an outside assessment, give its date and who did it under the assessment question, and ask your broker which question the insurer counts it under.

What can an outside reading show, and what can it not?

An outside reading attacks nothing and tries no password. It reads what your domain shows anyone, so it is not a penetration test and should not be called one.

It cannot see inside your network.

Which questions sit next to this one?

• Firewalls
• Remote access allowed