How the calculation works

Each question is worth up to the points in the table; the maximums add up to 100. A full answer earns all the points, a partial answer about half, and “No” or “Not sure” earns none: if you can’t confirm a control, you can’t state it on an application either. “We allow no remote access” counts as full points for remote-access MFA.

Score = points earned out of 100, rounded to a whole number.

Band:

  • Most controls in place: 80 or more, and every critical control at full points.
  • Important gaps: 50 to 79, or 80 or more with a critical control not fully in place.
  • Major gaps: below 50.

Gaps are every question below full points, listed by points lost (most first), then critical before other controls, then question order.

These weights are ITBroker.com’s own, not an insurer’s underwriting model. The five critical controls (MFA on email, remote access and privileged accounts, EDR, and separated backups) each appear as a direct question on the public forms we reviewed, and MFA, EDR and backups appear on both.

Control Points Critical Partial answer
MFA on email 10 Yes 5
MFA on remote access (staff and vendors) 10 Yes 5
MFA on privileged accounts 10 Yes 5
EDR on all endpoints 10 Yes 7 (all devices, not watched 24/7), 3 (some)
Separated backups (offline, immutable or separate cloud) 10 Yes 5
Backup restore testing 7 3 (more than a year ago)
Patching cadence 7 4 (within a month)
Security awareness training 7 4 (training without phishing simulations)
Privileged access management 7 4 (one of the two)
Email security 6 3 (basic spam filtering)
Incident response plan 6 3 (written, not tested)
Vendor risk 5 2
Logging and monitoring 5 2 (collected, rarely reviewed)

What the two public forms ask, in brief:

  • Tokio Marine HCC, CBO-RNA (4.2026): MFA on all remote access including VPN, RDP and remote management tools, for employees and third parties; EDR with centralized monitoring and logging, deployed and monitored on all workstations and servers; MFA on local and remote privileged access; MFA on webmail and non-corporate devices; immutable or separated backups with MFA on backup data; social engineering training with phishing simulations; a list of critical vendors.
  • Admiral, 182APP0323: EDR; MFA for remote access, privileged accounts and vendors; local admin rights; privileged account tooling; patch frequency; email tagging; yearly training and phishing testing; an incident response plan covering ransomware; backup frequency, testing, offsite storage and separate backup credentials.

Worked example

A 150-person company before its renewal answers:

Question Answer Points
MFA on email Yes, all users 10 of 10
MFA on remote access Yes, all of it 10 of 10
MFA on privileged accounts Some of them 5 of 10
EDR Every device, not watched 24/7 7 of 10
Separated backups Yes 10 of 10
Backup restore testing More than a year ago 3 of 7
Patching cadence Within 2 weeks 7 of 7
Security awareness training Training only 4 of 7
Email security Yes 6 of 6
Privileged access management One of them 4 of 7
Incident response plan No plan 0 of 6
Vendor risk Partly 2 of 5
Logging and monitoring Collected, rarely reviewed 2 of 5

Points earned: 10 + 10 + 5 + 7 + 10 + 3 + 7 + 4 + 6 + 4 + 0 + 2 + 2 = 70 out of 100, in the Important gaps band. Five of the 13 controls are fully in place.

The eight gaps, by points lost: incident response plan (6), MFA on privileged accounts (5, critical), backup restore testing (4), then EDR on all endpoints (3, critical, so first among the 3-point gaps), security awareness training, privileged access management, vendor risk and logging and monitoring. Privileged MFA and the incident response plan are the two an application is most likely to ask about in plain yes-or-no terms.

Sources