Get insurable. Stay insurable. Hand your broker the evidence.
The renewal questionnaire used to be a checkbox. Now it asks for proof — MFA everywhere, enforced email authentication, tested backups, a named incident-response plan — and it is due whether or not anyone on your team has ever seen a form like it. We score you against the 12 controls insurers actually probe, close the gaps, and hand your broker a page they can act on.
Read-only, enforced by Google and Microsoft — we never hold a password. Call or text (940) 281-6672
Why the questionnaire changed.
A few years ago the cyber-insurance application was a page of yes/no boxes nobody checked. Ransomware losses changed that. Carriers now ask for specifics — is MFA enforced on every account, is there a written incident-response plan, are backups actually tested — and increasingly they verify the answers before they pay a claim, not just before they write the policy.
Churches and small nonprofits are an odd fit for that shift. You hold member directories, giving records, and sometimes payment data — real PII, the same kind a hospital or bank protects — but almost never a paid IT staff person to answer a security questionnaire correctly. The form does not know that. It is due at renewal whether or not anyone on your team has ever seen it before.
One carrier's 2026 claims data shows why the payment questions got sharper. In 39% of funds-transfer fraud, the insurer found no confirmed compromise of the victim's email: the fraud worked without anyone breaking in (Coalition, 2026 Cyber Claims Report). Strong passwords and MFA do not stop that. A call-back procedure (control 11) and someone reading the incoming message are what give you a chance to catch it.
That gap is exactly what the Checkup closes: someone who reads these forms for a living tells you, in plain English, where you actually stand — before your renewal date, not after a claim gets denied.
The 12 controls insurers actually probe.
This is the Church & Small-Organization Insurance-Readiness Standard — the same 12 lines your scorecard is measured against. Print the full checklist at /insurance-checklist.html.
| Control | What the insurer is really asking | How Org Guard helps |
|---|---|---|
| 1. MFA on every email account | Can one stolen password alone get an attacker into a mailbox? | We check enforcement, not just availability, and close the gap on Guardian and above. |
| 2. MFA on admin & remote access | Is the console that controls everything else itself protected? | Included in every posture assessment; hardened on Guardian and above. |
| 3. Privileged accounts separated & reviewed | Does one compromised login hand over the whole organization? | We identify who holds admin rights and whether it is reviewed on a schedule; quarterly reviews included on Guardian Plus. |
| 4. Email authentication enforced (SPF/DKIM/DMARC at reject) | Can someone spoof your domain to phish your own members? | We read your published records and move you to enforced p=reject on Guardian and above. |
| 5. Filtering with human-verified alerting | Is targeted fraud — not just bulk spam — actually being caught? | Core to Org Guard: our engine flags, a Security Architect verifies, before you ever hear about it. |
| 6. Encrypted, offline-capable backups, actually tested | If ransomware hits, can you recover without paying? | We check the configuration and test cadence; managed backup with an annual restore test is scoped separately on Guardian Complete. |
| 7. Endpoint protection (EDR) on staff computers | Are the devices reading this email themselves protected? | We check current coverage; managed EDR is scoped separately on Guardian Complete. |
| 8. Written incident-response plan with named roles | Does anyone know what to do in the first hour of an incident? | We help you draft or tighten it; a joint practice run is included on Guardian Complete. |
| 9. Security-awareness training + phishing exercise, at least annually | Are your staff and volunteers the last line of defense, trained? | An annual threat-awareness talk is included from Guardian; an annual phishing simulation is included on Guardian Plus and above, with the date agreed at onboarding and the first exercise within your first year. |
| 10. Access reviews at least quarterly | Who can currently touch money, member data, and the admin console? | Quarterly access reviews are included on Guardian Plus and above. |
| 11. Vendor/payout-change verification (call-back procedure) | Would a fraudulent banking-change request actually get caught? | We write the procedure with you and watch for the warning signs that precede these attempts. |
| 12. Known-exploited-vulnerability & breach-exposure watch | Are you watching what attackers are using against organizations like yours this week? | Included in every plan — your domain against the published breach catalog and CISA's actively-exploited list. |
What the Cyber-Insurance Readiness Checkup delivers.
A one-time assessment built to answer the renewal questionnaire honestly — and to keep answering it, year after year, on Guardian Plus.
- Posture assessment of your Google Workspace or Microsoft 365
- Scorecard against all 12 controls — each line pass / gap / evidence quoted
- One-page, broker-ready summary
- Prioritized fix list, walked through on a call
- Includes the AI App Exposure Report
- Credited in full on a 12-month Guardian-or-higher plan started within 30 days
- $750 up to 15 users; $1,250 for 16–50; larger or multi-site quoted
- Organizations up to 50 staff accounts
- Everything in Guardian, plus the insurance concierge:
- Questionnaire completed alongside you at every renewal
- Gap-closing before the form goes back to your broker
- A fresh evidence packet handed over each renewal cycle
- Quarterly access reviews & an annual phishing simulation (first one within your first year)
Just need the outside-in basics watched — spoofing protection, breach watch, a monthly report — without the full checkup? Org Guard Essentials starts at $99/mo ($84 for churches & nonprofits) and covers up to 10 staff inboxes. For brokers who want to recommend this to their own book of church and nonprofit clients: /insurance-partners.html.
The artifacts, not just the scorecard.
Alongside the 12-control scorecard, the Checkup now produces the written material an insurer, a board, or your own next admin actually needs on hand:
- Incident classification & containment authority card — a one-page Tier 1/2/3 guide naming who may disable an account, who may take a service down, and who may call the carrier.
- RACI / decision-authority matrix — who is consulted, informed, and who actually decides, during an incident.
- Contact sheet & security.txt — deployed to your own site, so a researcher or a partner can reach a real person.
- Insurance policy review — notification clocks, panel-vendor restrictions, and any pre-breach service you're paying for and not using.
- 3-2-1-1-0 backup verification — with restore-test evidence, not a checkbox.
- Logging-prerequisites check — confirming the audit trail you'd need after an incident is actually being kept.
- Holding-statement template — a plain first sentence to say publicly in the first hour, before all the facts are in.
Mapped to NIST CSF 2.0.
The Checkup's deliverables line up with the six functions of the NIST Cybersecurity Framework 2.0 — the vocabulary most cyber-insurance questionnaires and auditors already use.
| Function | What the Checkup verifies or produces |
|---|---|
| Govern | Named decision makers, the RACI matrix, and the policy review — who is accountable for a decision before one has to be made. |
| Identify | The 12-control scorecard itself: where your organization actually stands today, with evidence quoted. |
| Protect | MFA, email authentication, access reviews, and the fix list that closes the gaps the scorecard finds. |
| Detect | The logging-prerequisites check — confirming the record exists that would let anyone detect an incident at all. |
| Respond | The containment authority card and the holding-statement template — who acts, and what gets said, in the first hour. |
| Recover | The 3-2-1-1-0 backup verification with restore-test evidence — proof recovery is possible, not assumed. |
Framework mapping adapted from Dynamic Incident Response by Joshua Wright, © 2026 SANS Institute, licensed CC BY 4.0.
Preparation feels like nothing, until it's everything.
Preparation is the hardest security spending to justify, because on a normal week it produces no visible result at all — the whole point is that nothing happens. It is also, by most accounts, the cheapest hour you will ever spend on an incident: the RACI matrix, the contact sheet, the backup test, all read like paperwork right up until the week you need to know who decides, who to call, and whether the backup actually restores. We would rather you file this stack of documents away for a year than write it under pressure at hour one.
For Texas organizations: Texas law (SB 2610, 2025) bars exemplary (punitive) damages in a data-breach lawsuit against a business with fewer than 250 employees that maintained a cybersecurity program conforming to a recognized framework. The Checkup's deliverables are built to be part of that documentation. This is general information, not legal advice — confirm your specific situation with your attorney.
From renewal panic to a page your broker can use.
Free snapshot call
Fifteen minutes on the phone. We ask a handful of questions about how your organization runs and tell you honestly whether the full Checkup is worth it for you right now.
The Checkup
A screen-share to connect read-only access, then an assessment against all 12 controls with evidence quoted for every line.
The fix list
A prioritized, plain-English list of gaps, walked through with you on a call — what to fix first and why.
The broker page
A one-page summary built to hand straight to your broker or insurer at renewal.
Stay insurable (Guardian Plus)
The concierge repeats the process at every renewal, so the evidence packet is never more than a year stale.
Fair questions, straight answers.
Will you fill out the insurance form for us?
We sit down with it alongside you — reading each question, telling you honestly whether you can answer it truthfully today, and closing the gap when you can't. The signature and the submission stay yours; insurers want the named officer of your organization attesting to the answers, not a vendor doing it for you.
Can you guarantee a lower premium?
No, and we would not trust anyone who tells you otherwise. Insurer pricing and approval decisions are theirs alone, based on your full application and their own risk appetite. What we can do is prepare the evidence your broker and insurer ask for and help close the gaps most commonly cited in declines — industry guides report proactive controls can be associated with premium reductions of up to about 20%, attributed as an industry pattern, never as our result.
Do you need our passwords?
No — ever. Assessment access is read-only, enforced by Google and Microsoft, granted by you from your own admin console, and revocable in one click. We never hold a password.
We already have an IT company — where do you fit?
Alongside them. Your IT company keeps things running; we read your configuration and logs against the 12 controls insurers actually probe and hand you (and your IT company) a specific, evidence-backed fix list instead of a vague renewal-form panic.
How long does the checkup take?
The assessment itself runs in the background against your admin console and public records. Expect a screen-share to connect read-only access, then your scorecard, broker page, and fix-list call within about a week.
What does our broker actually receive?
A one-page, plain-English summary built to be handed to a broker or insurer: which of the 12 controls pass, which have gaps, and the evidence behind each line — not a sales document, a document your broker can act on.
What if we fail most of the 12 controls today?
That is the most common starting point, not a disqualifier. The checkup exists to find exactly where you stand and hand you a prioritized order to close the gaps — most organizations we see improve quickly once MFA and email authentication are addressed first.
Do you work with our specific insurer or agent?
We are not appointed with any single carrier and we do not sell insurance. The scorecard and broker page are built to be carrier-neutral, so they travel with you to whichever broker or insurer you work with, at this renewal and the next one.
Start with a free insurance-readiness snapshot.
Fifteen minutes on the phone. We'll tell you honestly where you stand against the 12 controls and whether the full Checkup makes sense before your next renewal.
Get your free insurance-readiness snapshotOr simply call — (940) 281-6672 — and talk to the Security Architect directly.
Related
- The printable 12-control standard — read it before you sit down with the questionnaire.
- For brokers — recommend this to your church and nonprofit clients.
- Microsoft 365 Email Hardening Checklist — the settings a new tenant leaves off, in order of impact.
- Org Guard — the platform monitoring behind every control on this page.
Supports eligibility, underwriting readiness and risk reduction; does not guarantee premiums, coverage, claim payment or insurer approval.