How do I answer "Do you allow remote access to your network?" on a cyber insurance form?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you allow remote access to your network?

Remote access not permitted

Remote access to the Applicant's network limited to VPN

If you use an alternative method for securing remote access to your network, such as certificate-based authentication for devices, please provide details:

What does it mean for a small firm?

A small firm often has remote access it has forgotten: a remote desktop port opened for one person, a support tool left installed, a router's own login page.

One form asks whether remote access is limited to a VPN. Remote desktop reached straight from the internet is not a VPN.

How do I answer it truthfully?

Ask everyone who works away from the office how they reach the office systems, and ask any outside support company how it reaches them. Write each one down. That list is your answer, and the list the MFA question needs.

What can an outside reading check for this question?

An outside reading can see whether a remote desktop port, a file sharing port, or a VPN or other remote-access login page answers from the internet on your domain and its host names.

If remote desktop answers from the internet, "remote access not permitted" is not a true answer. It cannot see access that goes out from your office, such as a support tool that calls home.

Which questions sit next to this one?

• MFA on remote access
• VPN login pages
• Firewalls