InsureReady: the evidence behind your client's cyber-insurance application
Send us the application and a read-only Microsoft 365 consent. Within 5 business days you get every question mapped to evidence, a suggested answer for the client to confirm, and the gaps to fix before it goes to the carrier.
The client signs the application. We never sign or attest on anyone's behalf. Not insurance advice.
The problem
Cyber-insurance renewals have turned into security audits. Carriers no longer ask "do you have MFA?"; they ask which accounts, which access paths, and whether you can prove it. The person who ends up chasing those answers across Microsoft 365, the backup console and the RMM is usually the MSP, one client at a time, unpaid.
That's not our phrasing. It's what MSPs say on r/msp:
- "This one is seven pages with a 3 page ransomware rider. I can't remember them being quite this long in the past" (r/msp, "Client Cyber insurance renewals", Nov 2023)
- "each form from each company is different and is time consuming." (r/msp, "Cyber Insurance quote questionnaires, Do you bill to complete?", Mar 2023)
- "We are getting asked to help with cyber insurance questionnaires constantly." (r/msp, "Help with Cyber Insurance Questionaires.", Apr 2022)
And the liability worry is just as consistent. One MSP: "Our attorney said we should not fill those out. We are not insurance agents and we aren't the first party attesting to things." Another: "You dont check the boxes. Your client checks the boxes. You advise on which boxes they can check in good faith" (same r/msp thread). Cyberfox puts it plainly: "If you fill out a client's insurance questionnaire for them, you assume the risk." (Cyberfox). Attorney Brad Gross told ChannelPro: "With increasing frequency, we are seeing MSPs being asked to fill out these questionnaires" (ChannelPro, Oct 2023).
InsureReady is built around that line: we gather the evidence, the client checks the boxes.
The questions themselves are predictable. We wrote up what carriers ask MSPs to prove at renewal, quoted verbatim, in our ControlLedger guide: What cyber-insurance carriers ask MSPs to prove at renewal. InsureReady does that work for one specific application, for you.
How it works
- 1. SendOrder below. Within 1 business day we email you from [email protected] with intake steps. You send the client's application (PDF, Word or Excel, any carrier) and any backup or EDR reports you already have.
- 2. ConsentThe client's Global Administrator grants consent to our read-only Microsoft 365 assessment app. We read configuration; we change nothing.
- 3. ReceiveWithin 5 business days you get the evidence pack: each question, the evidence we found, a suggested answer marked "for the client to confirm", and the gaps to fix first. You review it with the client; the client signs.
What's in the pack
| Area | Evidence we gather |
|---|---|
| MFA | MFA registration per user, Conditional Access or Security Defaults policies, which sign-ins and admin roles are actually covered, and accounts that are excluded. |
| Privileged access | Who holds Global Admin and other privileged directory roles, and whether those accounts are separate from day-to-day accounts. |
| Backups | Microsoft 365 backup coverage and restore-test records, from the reports you send us from your backup tool. We flag when a restore test can't be evidenced. |
| Email security | SPF, DKIM and DMARC for the client's sending domains, with the DMARC policy level, plus legacy-authentication status. |
| Endpoint protection | EDR presence and device coverage where it is visible through Microsoft Defender or Intune, or from an RMM export you provide. |
| Gaps | A short, ordered list of what to fix before submitting, so the answers you give are true on the day the client signs. |
What we need, and it's read-only
- The application (or renewal questionnaire), any carrier.
- Read-only admin consent in the client's Microsoft 365 tenant for our assessment app. It uses the standard Microsoft Graph application-consent flow with read-only permissions only (for example
Directory.Read.All,Policy.Read.All,AuditLog.Read.All,Reports.Read.All). It has no write permissions, installs no agent, and can be removed in Entra ID as soon as the pack is delivered. - Optional exports from your backup and RMM or EDR tools, if you want those questions evidenced too.
Data is used only to prepare the pack, is not shared with any carrier or broker, and is deleted 30 days after delivery unless you ask us to delete it sooner.
Who signs, and who is liable
That's deliberate. Misstatements on an application can void coverage, and an MSP who signs or answers for a client can end up in the middle of that dispute. The pack gives your client the facts to answer truthfully; the decision and the signature stay with them.
What it does not do
- Not insurance advice. We are not an insurance broker or agent and don't recommend carriers or policies.
- No guarantee of coverage, eligibility or premium. The carrier decides.
- No signing or attesting. See above.
- No changes to the tenant. We read configuration only. Fixing the gaps is up to you and the client.
- Not an audit or certification. This is not SOC 2, ISO 27001, CMMC or a penetration test.
- Microsoft 365 only for now. Google Workspace tenants: ask first.
Founding price
| Offer | Price | Terms |
|---|---|---|
| InsureReady evidence pack per client application |
$49 | Founding price for the first 10 MSPs. Delivered within 5 business days of intake, or a full refund. Buying for several clients? Set the quantity at checkout. Order a pack, $49 |
Checkout asks for the client company name and the carrier, if known. You get a receipt and an invoice from Stripe.
FAQ
- Do you sign or attest to the application?
- No. The client signs. We never sign, attest or submit on anyone's behalf, and every suggested answer is marked for the client to confirm.
- Should the MSP sign it instead?
- We'd suggest not, but that's between you, your client and your own counsel. The pack is written so the client can answer for themselves.
- What access do you need, exactly?
- A copy of the application, plus read-only Microsoft Graph consent granted by the client's Global Administrator. No write permissions and no agent install. You can revoke the consent as soon as the pack is delivered.
- Which carriers do you support?
- Any application or renewal questionnaire you can send as a PDF, Word or Excel file. Tell us the carrier at checkout if you know it.
- What if a question can't be answered from Microsoft 365?
- Some can't, such as backup restore tests or physical security. Those questions are listed with what evidence would answer them, and evidenced from your own exports if you send them.
- How is the work done?
- Our agents pull the read-only data and draft the mapping; a person reviews every answer and every gap before you see the pack.
- Is this insurance advice? Will it lower the premium?
- No and no guarantee. We are not a broker. The carrier sets coverage and premium.
- What if you're late?
- If the pack isn't delivered within 5 business days of intake (application plus consent received), you get a full refund.
- What happens to the client's data?
- It's used only to prepare the pack, never shared with a carrier or broker, and deleted 30 days after delivery, or sooner on request.
Talk to us
Questions, a renewal coming up, or a carrier form you want us to look at first? Email [email protected].