I swapped 2 of the usual tags (webdev, ai) for devops and startup because this piece is about infrastructure evidence. Swap back if you prefer.

Someone will eventually ask you to confirm the “yes” boxes on a cyber insurance application. MFA everywhere. EDR on every host. Clean email authentication. Nothing exposed. Here’s how to produce evidence instead of opinions.

Why it matters... in 2022 an insurer and a manufacturer agreed to an order rescinding a cyber policy and declaring it void from inception after the insurer said MFA protected only the firewall. Evidence is the difference between a yes and a maybe.

MFA... find the accounts that break your “yes”

AWS IAM users with console passwords but no MFA-

`aws iam generate-credential-report

wait a few seconds, then (use base64 -D on macOS):

aws iam get-credential-report --query Content --output text | base64 -d \
| awk -F, 'NR>1 && $4=="true" && $8=="false" {print $1}'`

That lists IAM users with a password and no MFA. It misses your identity provider, which is where most staff accounts live. Export the same view from Okta, Entra or Google Workspace. The target list length is zero.

EDR... diff the agents against the inventory

Insurers care whether EDR is on every server, including the forgotten ones-

sort -u assets.txt > a.txt
sort -u edr-agents.txt > e.txt
comm -23 a.txt e.txt # in inventory, missing from EDR

Anything printed is a host your “yes” doesn’t cover.

Email authentication... anyone can check it, including the carrier

Underwriters look for SPF, DKIM and DMARC, with DMARC set to reject.

dig +short TXT _dmarc.example.com # want p=reject
dig +short TXT example.com | grep -i spf

Exposed remote access... scan only what you own

An analysis of published carrier forms says Beazley asks whether RDP is exposed to the internet.

# only scan IP ranges you own or are authorized to test
nmap -Pn -p 3389,445,5900 203.0.113.10

Backups... keep a restore log

A nightly job isn’t evidence. A dated restore is.

echo "$(date -u +%FT%TZ) restore-test db=orders result=ok" >> restore-log.txt

Package it

One folder per control, one dated export per answer, one owner per folder. Begin about 90 days before renewal and reconcile every answer with evidence. When the broker’s questionnaire arrives, your answers already exist.

Not legal advice. Ask your broker and a coverage lawyer about rescission rules in your state. Disclosure: I do security consulting at Snippipedia).