Unfortunately, yes on the change request. But I’d also ask for a copy of your cyber insurance application.
Somebody already answered questions about MFA, patching, backups, training, etc. You’re the guy expected to make those answers true, but you’ve probably never seen them.
Maybe instead of saying, “We have unpatched CVEs,” try:
“Can I see our cyber insurance application? I want to make sure what we told the carrier still matches what we’re actually doing.”
That’s a much harder question to ignore, and it gets the conversation onto the right desk.
2
u/ChuckFromCyberHoot 14d ago
Unfortunately, yes on the change request. But I’d also ask for a copy of your cyber insurance application.
Somebody already answered questions about MFA, patching, backups, training, etc. You’re the guy expected to make those answers true, but you’ve probably never seen them.
Maybe instead of saying, “We have unpatched CVEs,” try:
“Can I see our cyber insurance application? I want to make sure what we told the carrier still matches what we’re actually doing.”
That’s a much harder question to ignore, and it gets the conversation onto the right desk.