Practice note
What your 2026 cyber application will actually ask
The question is no longer whether MFA exists. It is whether MFA is enforced on email, remote access, and privileged accounts. DMARC at none is a gift to the next BEC. Unpatched internet-facing systems still show up on claims.
Bring the form you have. The Cyber insurance packet maps live controls to that form. Baseline keeps the evidence from going stale after bind.