In short: MFA for cyber insurance usually means showing that email, remote access, administrator and privileged accounts, and backup systems all require a second factor. Cisco Duo can cover each of these, from Microsoft 365 and VPNs to Windows logon and admin consoles, and the Duo Admin Panel provides logs and reports as evidence. Always check your insurer's own questionnaire.
Why insurers ask about MFA
Insurers decide whether to offer cover, and on what terms, partly from the answers on your proposal form or renewal questionnaire. Multi-factor authentication questions appear on many of these forms because stolen or phished passwords are a common route into a business.
Every insurer words its questions differently, and requirements change between renewals, so we never assume what yours asks: check your insurer's questionnaire, and talk to your broker if a question is unclear. Under the Insurance Act 2015, businesses have a duty to make a fair presentation of the risk when they buy cover, so an answer of 'yes, we use MFA' should reflect what is actually configured, not what you plan to do.
The areas proposal forms commonly ask about
Questions typically group into four or five areas. This is how Duo can cover each one:
| Area | What to protect | How Duo covers it |
|---|---|---|
| Email and cloud apps | Microsoft 365, Google Workspace and other SaaS | Duo for Microsoft 365 through Entra ID: External MFA or SSO federation; Duo for Google Workspace and other apps through Duo SSO |
| Remote access | VPNs, remote desktop, remote access tools and supplier access | Duo VPN MFA, Windows Logon and RDP, RD Gateway, and VPN-less access through Duo Network Gateway in Premier |
| Administrator and privileged accounts | Domain and cloud admins, servers, firewalls and cloud consoles | Windows Logon on servers, Duo Unix for Linux SSH, SSO for admin portals and the AWS console |
| Backups | The consoles that manage and can delete your backups | Duo SSO or the Authentication Proxy where the backup product supports SAML or RADIUS; otherwise its own MFA, switched on |
| Workstations | Laptop and desktop logons, especially for finance and admin staff | Windows Logon (with offline access from Essentials) and Duo for macOS |
Backups deserve special attention. If an attacker can sign in to the backup console with a stolen domain password, they can delete the very copies you would recover from. Use separate admin accounts for backup systems, keep them out of everyday use, and put MFA in front of them.
Answering 'yes' honestly: check the exceptions
MFA projects often leave small holes that make a 'yes' less true than it looks. Before you sign a proposal form, check for:
- Users in bypass status or groups with a policy that lets them skip MFA, often left over from the roll-out
- Authorised networks policies that let anyone in the office log in without a second factor
- Service accounts and shared mailboxes with interactive logins and no MFA
- Break-glass accounts, which need protecting, monitoring and documenting rather than ignoring
- Fail-open settings on the Authentication Proxy, which let users in on a password alone when Duo cannot be reached
- Applications nobody added to Duo, such as a new SaaS tool or a supplier's remote support portal
Cisco Identity Intelligence, included in Duo Advantage and Duo Premier, looks across Duo and your other identity systems for accounts with no MFA or only weak methods, dormant accounts and risky administrators. That turns a guess into a list you can fix.
Evidence from the Duo Admin Panel
If an insurer, broker or auditor asks you to back up your answers, the Duo Admin Panel is where the evidence lives:
- Applications: every protected service, which maps directly onto the questionnaire's areas
- Users: enrolment status and authentication methods for each person
- Policies: which applications require MFA and which methods are allowed
- Authentication log: a record of each login, the factor used and the result
- Administrator log: changes to policies and settings, useful when you need to show controls were not quietly relaxed
We suggest keeping a short, dated MFA summary with screenshots each year before renewal. It makes the next questionnaire quicker and gives you something to show if a claim is ever examined.
Going beyond the minimum
If your questionnaire asks what kind of MFA you use, stronger methods help you answer well. Verified Duo Push, available from Duo Essentials, makes the user type a code shown on the login screen into Duo Mobile, which helps stop push-fatigue ("push bombing") attacks. Passkeys and FIDO2 security keys, covered on our passwordless page, are phishing-resistant because they only work on the genuine site. Risk-based authentication in Advantage and Premier steps up to stronger factors when a login looks unusual.
Technology is only half the answer: staff also need to know never to approve a prompt they did not start. Our sister site offers phishing awareness training that covers MFA fatigue attacks. Many of the same controls also count towards Cyber Essentials.
How we help
We take your insurer's questionnaire, map each MFA question to the systems it covers, and show you where you stand. Then we close the gaps with Duo, or with native MFA where that is simpler, and produce an evidence summary you can keep for renewal. We do not give insurance advice or predict premiums; that is for your broker and insurer.
Contact us before your renewal date, ideally a couple of months ahead, so there is time to roll out properly.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do cyber insurers require MFA?
Many cyber insurance proposal forms ask whether MFA protects email, remote access, administrator accounts and backups, and the answers can affect whether and how cover is offered. Requirements vary between insurers and change over time, so check your insurer's questionnaire and ask your broker.
What counts as MFA for cyber insurance?
Generally a login that needs two different types of factor, such as a password plus an approval in an authenticator app, a hardware token or a security key. Passkeys also count. Your insurer's wording decides what it accepts, so read the definitions in the questionnaire.
Can Cisco Duo protect our backups?
Often, yes. Where a backup console supports SAML or RADIUS, Duo can protect its logins through Duo Single Sign-On or the Authentication Proxy. Where it does not, switch on the product's own MFA and use separate backup admin accounts.
How can we prove to an insurer that we use MFA?
The Duo Admin Panel shows protected applications, users' enrolment status, policies and an authentication log of each login and the factor used. A dated summary with screenshots, kept with your renewal papers, is usually the simplest evidence.
Will adding MFA reduce our cyber insurance premium?
We cannot say. Premiums and terms are set by your insurer. What MFA does is let you answer the security questions accurately and reduce the risk of the account takeovers that lead to claims.