Capital Techies Cyber Insurance Calculator

Welcome to the Capital Techies Cyber Insurance Calculator!

Click below to begin your assessment.

PRIVACY

Does your company have a Chief Privacy Officer?

A Chief Privacy Officer (CPO) is a senior executive responsible for developing and implementing an organization's privacy policies and strategies.

PRIVACY

Does your company have a publicly available Privacy Policy?

A publicly available privacy policy is a statement of how an organization collects, uses, and protects the personal information of its customers.

NETWORK SECURITY

Does your company use up-to-date firewalls?

An up-to-date firewall is a security system that monitors and controls network traffic and is configured with the latest updates to protect against emerging threats.

NETWORK SECURITY

Does your company use multifactor authentication (MFA) for remote system access or any access that connects to networks with cardholder data?

MFA, also called two-factor authentication or 2FA, requires users to provide two or more forms of identification before granting access to a system.

NETWORK SECURITY

Does your company enforce minimum password complexity requirements?

For example, minimum password length, character requirements, or rules about uniqueness.

NETWORK SECURITY

Does your company engage in regular periodic penetration testing to determine vulnerabilities?

Penetration testing, also known as "white hat" hacking, uses simulated attacks to identify system vulnerabilities. It is recommended to be conducted at least annually.

NETWORK SECURITY

Does your company use Endpoint Detection & Response (EDR) tools to monitor your systems and networks?

EDR technology monitors and responds to cyber threats at endpoints like laptops, desktops, and mobile devices, using advanced analytics and machine learning.

STANDARDS AND COMPLIANCE

Does your company require annual Security Awareness Training for all employees?

Security Awareness Training is education provided to staff about cybersecurity risks.

STANDARDS AND COMPLIANCE

Does your company maintain an inventory of sensitive data?

Sensitive data includes cardholder data (e.g., credit card numbers, PINs, CVV), passwords, addresses, email addresses, dates of birth, and personally identifiable information (e.g., biometric or health information).

STANDARDS AND COMPLIANCE

Does your company use end-to-end encryption when transmitting cardholder data?

End-to-end encryption is a security measure that protects cardholder data by encoding it at the point of origin and decoding it only at the intended destination, preventing unauthorized access during transmission.

STANDARDS AND COMPLIANCE

Does your company conduct annual audits to verify compliance with formal Information Security Policies?

Audits refer to the process of reviewing and evaluating security controls and practices against established policies to ensure they are being followed correctly.

STANDARDS AND COMPLIANCE

Does your company maintain and enforce policies that require minimum security controls from third-party vendors?

Vendor controls include, but are not limited to, policies that specify minimum vendor security standards, periodic review of vendor access rights, prompt revocation of unneeded vendor rights, and logging and monitoring vendor access to the company's system.

LAPTOP AND MOBILE DEVICES

Does your company enforce a policy of privileged access management?

Privileged access management is controlling and monitoring access to critical systems by "privileged users" such as system administrators and IT personnel.

LAPTOP AND MOBILE DEVICES

Does your company require the use of a Virtual Private Network (VPN) for remote system access?

A VPN is a secure, encrypted connection between a device and a remote server, allowing the user to access a private network as if they were directly connected.

LAPTOP AND MOBILE DEVICES

Does your company store and monitor network and security logs?

Network and security logs" are records of network activity and security-related events that are captured to monitor potential security threats.

LAPTOP AND MOBILE DEVICES

Does your company maintain a formal policy governing Data Retention & Disposal?

Data Retention & Disposal policy is an organizational-level Information Policy governing the handling of data.

INCIDENT RESPONSE

Does your company have a written Incident Response Plan (IRP)?

An IRP is a pre-defined procedure for minimizing damage and facilitating recovery after a cybersecurity event.

INCIDENT RESPONSE

Does your company have a recovery time objective of less than 24 hours?

Recovery Time Objective is the estimated amount of time it will take to restore critical business functions following a network or systems interruption.

INCIDENT RESPONSE

Does your company use segregated end-of-life software?

Segregated end-of-life software is software no longer supported by the vendor. It is recommended to isolate this software from active systems as a precautionary measure.

INCIDENT RESPONSE

Does your company store its data backups on air-gapped networks or devices?

An air-gapped network or device is a computer or network that is physically isolated from the internet or any other unsecured network.

Capital Techies Insurance Calculator

Thank you for completing the Cybersecurity Insurance Calculator intake questionnaire.
We're crunching the numbers to produce your results.
To see your score and estimated premium, enter the following information: