The short answer
Yes, almost certainly. 99% of cyber insurance applications now ask about multi-factor authentication, and carriers have moved from asking to verifying. A "yes" you cannot back up can void coverage at claim time.
What carriers actually check
Carriers care about MFA on three specific surfaces:
- Email, because it resets every other account
- VPN and remote access
- Administrator accounts
If any of these are protected only by a password, you have the single most common gap D1 Cyber closes. The other gaps carriers flag: SPF, DKIM, and DMARC on your domain, tested and immutable backups, and endpoint detection on workstations.
Why "yes" is no longer enough
Carriers scan your attack surface before binding. About 75% run an external scan before they quote, and roughly 55% of insured SMBs must prove specific controls to keep coverage. An application answer that does not match what the scan finds turns into an exclusion, a higher premium, or a declination.
Closing the gap before renewal
- Enforce MFA on every email, VPN, and admin account. App-based or hardware keys beat SMS.
- Turn on SPF, DKIM, and DMARC, and verify the records rather than just confirming they exist.
- Confirm backups are tested and immutable.
- Document all of it. Carriers accept evidence, not assertions.
Most engagements finish in two to four weeks. A readiness assessment tells you in plain English which questions you cannot answer "yes" to today, then we close them and produce the documentation your broker and carrier accept.
The question to ask your broker
Before renewal, ask which controls the carrier will verify this year. The answer usually starts with MFA. If you cannot prove it, that is the gap to close first.