Renewals

Cyber insurance readiness check

This is not a quote, a binder, or a promise that a carrier will insure you. Application questions differ. The rows below say what CyberEnforced can show and what it cannot.

Check the domain on the application

Use the same preview as the free domain security scan. It covers SPF, DMARC, seventeen built-in DKIM selectors plus one you type, MTA-STS, TLS-RPT, and TLS on port 443, plus a preview score out of 100 and a glance at four HTTP headers. It does not store a report. Create an account when you need CSV, PDF, or a revocable link to attach.

Results show up here. Nothing is saved on an account. After a check, you can make a 24-hour link. That link is not a saved report.

What insurers often ask, and what we can show

Email authentication (SPF, DKIM, DMARC)

What we can show. The preview and a saved scan show whether SPF and DMARC are published, and whether DMARC is p=none, quarantine, or reject. The preview checks seventeen built-in DKIM selectors, one optional selector you type, MTA-STS, and TLS-RPT, and shows a score out of 100. Saved DKIM, MTA-STS, and TLS-RPT findings are Pro checks.

What we cannot show. That every outbound message is signed, or that a selector you did not check is absent.

TLS on the website or app hostname

What we can show. Whether port 443 presents a certificate that verifies for the hostname you enter, plus the issuer and expiry when the handshake succeeds.

What we cannot show. TLS inside a private network, or mail-server STARTTLS. STARTTLS on MX hosts is a Pro check on a saved scan.

Multi-factor authentication

What we can show. CyberEnforced accounts can turn on TOTP. That is evidence for those accounts only.

What we cannot show. MFA on Microsoft 365, Google Workspace, a VPN, or any other system. A domain scan does not read your identity provider.

Security awareness training

What we can show. The Training & Awareness add-on assigns catalog courses and records who passed, including "Spot It. Stop It. Report It."

What we cannot show. That a carrier will accept the course, or a training history from before you assigned it.

Policies and incident response

What we can show. The GRC add-on stores policies, versions, and acknowledgments, and a risk register. Evidence notes are manual.

What we cannot show. An automated pull from AWS, Okta, or GitHub, or a legal opinion that a policy is sufficient.

Vendors and third parties

What we can show. The Vendor Security add-on is an inventory with criticality, review status, and a next-review date.

What we cannot show. A scan of the vendor’s own environment.

Backups, EDR, and endpoint controls

What we can show. Nothing. CyberEnforced does not check these.

What we cannot show. Whether backups run, whether an EDR agent is installed, or whether laptops are encrypted.

Proof you can send

A saved scan can be downloaded as CSV or PDF, or sent as a link that works without a login. You can revoke that account link when the review is over. The preview on this page is not that report. An optional 24-hour preview link is a signed snapshot and cannot be revoked from a dashboard. The sample illustration is not evidence.

Create a free account See pricing

Accounts are for people 18 or older who are creating a business account, or an account they are authorized to create.

Renewal checklist

Run the domain check on the hostname the application names.
If SPF is missing or ends in +all, fix that before you answer that sending servers are restricted.
If DMARC is missing, say so. If it is p=none, describe it as monitor mode, not as quarantine or reject.
If the preview does not see a checked DKIM selector, check the mail provider before you answer. A selector that was not checked can still be valid. A saved DKIM finding is a Pro check.
If the certificate does not verify, do not answer that HTTPS is in place for that hostname. If it does, note the expiry.
Answer MFA, training, backup, and endpoint questions from the systems that actually do those jobs.
Create an account, add the domain, and export CSV or PDF, or send a revocable report link. Do not send the sample illustration.

Insurance questions

Will this check get my company cyber insurance?

No. Carriers decide coverage, price, and which evidence they accept. CyberEnforced does not quote, bind, or guarantee a policy. The readiness page maps common application questions to checks we can actually show.

Which application questions can a domain scan support?

Email authentication and TLS on the hostname you check. SPF and DMARC are on the preview and on free saved scans. The preview checks built-in DKIM selectors, one optional selector you type, MTA-STS, and TLS-RPT. Saved DKIM, MTA-STS, and TLS-RPT findings are Pro checks. The scan does not prove that every message is signed.

Does CyberEnforced prove we use MFA?

It can show opt-in TOTP on CyberEnforced accounts. It does not read Microsoft 365, Google Workspace, a VPN, or any other identity provider. Answer the MFA question from those systems.

Can I attach a CyberEnforced report to a renewal?

After you save the domain on an account, you can download CSV or PDF findings or send a revocable report link. The recipient does not need a login. Turn the link off when the review is done. Do not send the sample illustration.

Does staff training show up on the domain scan?

No. Training & Awareness is a separate add-on on Pro. It assigns catalog courses and records who passed. A carrier may still want its own course, or a longer history than you have.

What will a domain scan not answer on an application?

Backups, endpoint detection, office firewalls, MFA on other systems, and whether a carrier will bind a policy. GRC evidence is a notes field, not an automated pull from AWS, Okta, or GitHub.