MFA coverage
An export of MFA registration and enforcement by user type, including admins and service accounts, with exceptions listed by name.
For insurers and brokers
What 4IR prepares for your client
We prepare dated Microsoft 365 evidence for organisations with 20 to 50 staff: exports taken directly from the client’s tenant, plus copies of the supporting documents in scope. The evidence is prepared for the client, the client owns it, and the client decides what to share with you.
What the client receives
Tenant exports come directly from the client’s systems and record the date, time and method of collection. Plans, procedures and exercise records are dated copies of the client’s own documents. Together they are a factual record of what was in place at that moment, not a rating or an opinion.
Admin roles and privileged access
Who holds which admin roles, whether access is standing or time-bound, and whether admin accounts are separate from day-to-day accounts.
Backup restore tests
Where a restore test is in scope, a dated record of it: what was restored, from where, how long it took and whether it worked.
Email authentication
SPF, DKIM and DMARC records and policy for each sending domain, as published on the date of collection.
Conditional access and devices
The sign-in policies in force, and EDR (such as Defender for Endpoint) onboarding and sensor health across managed devices.
Plans and exercises
The incident response plan’s version and review date, and the date and attendance of the most recent tabletop exercise, where these are in scope.
Common questions, and the evidence behind them
Proposal forms differ between insurers. This is the evidence we prepare for the control questions they most commonly ask. The client answers its own proposal form.
| Typical question | Evidence prepared for the client | Also useful for |
|---|---|---|
| Is MFA enforced for all users, including remote and email access? | Dated MFA registration and enforcement export by user type, with named exceptions | Essential Eight ML2; customer schedules |
| Do privileged accounts use stronger MFA? | Admin role assignments and the authentication methods each admin uses | Essential Eight ML2 |
| How is privileged access controlled? | Standing vs time-bound role assignments, separate admin accounts, last access review | Essential Eight ML2; customer schedules |
| Are backups kept separately and tested? | Backup configuration summary, and a dated restore test record where in scope | Essential Eight ML2 |
| Is endpoint detection and response in place? | EDR (such as Defender for Endpoint) onboarding and sensor health across managed devices, with devices not onboarded listed | Customer schedules |
| Are SPF, DKIM and DMARC configured? | Published records and DMARC policy for each sending domain, on the collection date | Customer schedules |
| How quickly are operating systems and applications patched? | Update compliance summary from device management, by device group | Essential Eight ML2 |
| Is there a tested incident response plan? | Plan version and review date; tabletop date, scenario and attendees | Customer schedules |
| How are payment detail changes verified? | The documented call-back procedure and any mail rules or alerts supporting it | Customer schedules |
| How is supplier and MSP access controlled? | List of external and delegated admin access, with scope and review date | Essential Eight ML2; customer schedules |
“Essential Eight ML2” is Maturity Level 2 of ASD’s Essential Eight, which the Defence Industry Security Program (DISP) requires of its members. “Customer schedules” means the security schedules and questionnaires enterprise customers send their suppliers.
Independence
- We work for the client. The client engages and pays 4IR directly.
- No referral fees. 4IR doesn’t receive or pay referral fees, commissions or other inducements, to or from insurers, brokers or vendors.
- No attestation. We don’t certify, attest or make statements to insurers or brokers on the client’s behalf. Evidence is prepared for the client only and isn’t intended to be relied on by anyone else.
- The client decides what to share. What reaches a broker or insurer, and when, is the client’s call.
- No products to sell. 4IR doesn’t sell insurance or security software, or take over the client’s managed IT services.
- Insurance. 4IR holds professional indemnity and public liability insurance. Certificates of currency are available on request.
How a client engages 4IR
The client contacts us directly by email. Please don’t send us your client’s details; pass on the address below instead. After a short scoping call on what they’ve been asked for and by when, the client receives an engagement letter with the scope, dates and fee. The evidence is delivered to the client, who decides what to share. Clients who get in touch well ahead of their renewal date can be scheduled to meet it.