Let's be honest: cybersecurity hasn't been an enterprise-specific issue in years. 

In fact, cyber criminals are going out of their way to target MSPs, because if they compromise an MSP's environments, they don't only get access to one company's sensitive data - they could potentially steal data from thousands of users and organizations. Outside of the traditional detection and response security solutions, MSPs continue to work on their incident readiness, which includes getting a cyber insurance policy to cover themselves in the event of an incident. 

But there's one major problem: Cyber insurance providers are also worried about the risks that they'd be supporting MSPs for. They aren't just asking MSPs to identify themselves in insurance applications and risk assessments, they're also requiring proof beyond the checked box that MSPs have properly implemented the security solutions they need to be eligible for coverage and compliant with best practices. 

At Evo, we believe that aligning with cyber insurance starts with proper identity security. 

No vendor (including us) can claim to comply or help you, the reader, as an MSP, achieve insurance eligibility, but we've put together a guide that can help you prepare for conversations with your insurance brokers, whether you're applying for your first policy or negotiating for renewal. You can download the full guide here or get the highlights on what insurance providers care about below:

MFA is the Most Fundamental Requirement

Every cyber insurance provider has slightly different requirements, but every one agrees on one thing: MSPs and SMBs must have MFA rolled out as an additional layer of security around their endpoints, web applications, servers, network devices, and more. 

While MSPs have a variety of cost-effective MFA solutions that'll cover your web apps and email to choose from, the key is identifying an MFA solution that will cover all of the surfaces your providers recover that isn't a pain to manage. A good IAM solution won't just stop at deployment - it'll help you prove that MFA is active across your security estate. 

Evo Identity Management doesn't just let you roll out MFA to your customers. Our multi-tenant portal gives you visibility into your MFA posture across all of your customers and supports all of the attack surfaces your insurance policy will care about.

MSPs Have to Prove They're Focused on Identity and Access

Because cyber insurance providers are responsible for covering several verticals, they've got a greater understanding of access and governance than your typical stakeholder or vendor contact. They won't just be looking at whether your Active Directory is locked down—they'll be evaluating how you organize, manage, and secure your user accounts and endpoints. 

While having written and implemented policies and processes for proper user identity management ultimately lies with your MSP, Identity and Access Management (IAM) will be crucial to automating those processes across customers and letting you dive down on a per-customer basis to identify user accounts that need attention. 

Cyber Insurers Know Privileged Access is a Major Threat Vector

If you've kept up with any of the data breaches in the news cycle over the last five years, you know what privilege escalation and lateral movement are -- and cyber insurers do too. While many of the eligibility questionnaires will give MSPs some wiggle room in just generally calling for MFA or IAM for specific attack surfaces, insurers will usually ask more detailed questions on:

- Where your privileged access exists

- Exactly how you're managing it

- And what you're doing to achieve zero standing privileges

Most importantly, these are the type of people who will be asking you how you're removing local admin rights from end users and taking steps to enforce least privileges. 

Proactively Mitigate Your Cyber Risk

Getting and maintaining a cyber insurance policy can be one of the most time-consuming and taxing processes for your MSP. However, in a world where security practitioners are saying it’s a matter of “when, not if” a vendor or a company is compromised, proper insurance coverage is more important than ever. 

At Evo, we’re not just selling you a point-specific security platform. We care about keeping you up-to-speed on the latest identity-based threats, and prepping you for conversations with both your provider and your end users on steps you’re taking to ensure their safety. 

Ready to see what proactive protection for admin privileges and user identities looks like? You can connect with us today.