Cyber Insurance Requirements

MFA, EDR, Backups & Underwriter Questionnaires

Cyber insurance has moved from a simple risk-transfer decision to a technical due-diligence exercise. Underwriters commonly ask detailed questions about controls such as:

• MFA for email, remote access, and privileged accounts
• Endpoint protection or EDR
• Backup isolation and restoration testing
• Security-awareness training
• Patch and vulnerability management
• Email security
• Incident-response planning
• Privileged-access controls
• Remote-access security

The most important time to discover a gap is before the application is signed or a claim occurs. Preactive IT helps construction firms compare the controls they have in place with the controls they’re being asked to represent, then close technical gaps where appropriate.

Owner, GC & Contractual Security Requirements

Entra ID, Conditional Access & Access Flow-Downs

Cybersecurity expectations increasingly flow down through project relationships. An owner may impose security requirements on the general contractor, which then passes requirements to subcontractors, consultants, and vendors.

Those requirements may cover access to project platforms, protection of confidential information, notification after an incident, use of MFA, device security, subcontractor access, or data retention.

A documented identity and access process makes these requirements easier to manage. Microsoft Entra ID, Intune, Conditional Access, role-based permissions, named user accounts, and consistent onboarding/offboarding can provide stronger control over employees, subcontractors, and outside collaborators.

Auditability: Proving the Control Exists

Evidence, Logs & Documentation That Hold Up

A security control is more useful when the organization can demonstrate it. Construction firms may need evidence such as:

• User and administrator account inventories
• MFA and Conditional Access policies
• Endpoint protection status
• Patch and vulnerability reports
• Backup success and restoration-test records
• Security-monitoring and alert records
• Incident-response plans and tabletop exercises
• Help-desk tickets documenting remediation
• Access reviews for subcontractors or former employees

Preactive IT’s process — Audit, Prioritize, Plan, Execute, Review — naturally creates opportunities to document controls instead of treating compliance evidence as an emergency project before an audit or renewal.