<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ransomware-insurance-readiness
description: >-
  Prepare organizations for cyber insurance applications and claims related
  to ransomware. Covers evidence collection for insurability, compliance
  with policy requirements (MFA, EDR, backup verification), documentation
  of security controls for underwriters, and post-incident claims
  preparation including forensic evidence preservation.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - cyber-insurance
  - insurability
  - mfa-compliance
  - edr-deployment
  - backup-verification
  - underwriting
  - claims-preparation
  - evidence-collection
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Ransomware Insurance Readiness

## Overview

Cyber insurance underwriters have dramatically tightened requirements since
2021. Organizations must demonstrate specific security controls — MFA on
all remote access, EDR on all endpoints, immutable backups, and incident
response plans — to qualify for coverage. Post-incident, claims require
forensic evidence preservation, timeline documentation, and proof that
policy-required controls were active.

Insurance readiness is a forcing function for security maturity that
directly reduces ransomware risk.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Lynis | Security auditing | `apt install lynis` |
| osquery | Endpoint compliance queries | Package install |
| OpenSCAP | SCAP compliance scanning | `apt install openscap-scanner` |
| jq | JSON parsing | `apt install jq` |
| aide | File integrity monitoring | `apt install aide` |

## Key Concepts

### Common Underwriter Requirements (2024-2026)

```
Requirement 1:  MFA on all remote access (VPN, RDP, email, admin portals)
Requirement 2:  EDR deployed on 100% of endpoints
Requirement 3:  Offline or immutable backups tested quarterly
Requirement 4:  Privileged access management (PAM) implemented
Requirement 5:  Email filtering with attachment sandboxing
Requirement 6:  Patch management within 30 days for critical CVEs
Requirement 7:  Network segmentation between IT and OT
Requirement 8:  Incident response plan tested annually
Requirement 9:  Security awareness training for all employees
Requirement 10: 24/7 monitoring capability (SOC or MDR)
```

### Insurance Readiness Maturity Levels

| Level | Description | Insurability |
|-------|-------------|-------------|
| 1 — Ad Hoc | No documented controls | Uninsurable |
| 2 — Basic | AV + firewall, no MFA | High premium, exclusions |
| 3 — Managed | MFA + EDR + backups | Standard coverage |
| 4 — Optimized | Full stack + testing | Preferred rates |
| 5 — Resilient | Purple team + immutable | Best rates, higher limits |

## Workflow

### Step 1 — Audit MFA Deployment Coverage

```bash
# Check PAM configuration for MFA requirements
grep -rn "pam_google_authenticator\|pam_duo\|pam_u2f" /etc/pam.d/ 2>/dev/null

# Verify SSH requires MFA (not just password)
grep -E "^(PasswordAuthentication|ChallengeResponseAuthentication|AuthenticationMethods)" \
  /etc/ssh/sshd_config

# Document MFA coverage for underwriter
echo "=== MFA Coverage Report ==="
echo "SSH: $(grep 'AuthenticationMethods' /etc/ssh/sshd_config 2>/dev/null || echo 'NOT CONFIGURED')"
echo "PAM MFA: $(grep -l 'pam_duo\|pam_google' /etc/pam.d/* 2>/dev/null | wc -l) services"
```

### Step 2 — Verify EDR Deployment and Health

```bash
# Check for common EDR agents
for agent in falcon-sensor carbonblack cylance sentinelone mdatp; do
  if systemctl is-active "$agent" 2>/dev/null | grep -q active; then
    echo "[+] $agent: RUNNING"
  elif pgrep -f "$agent" >/dev/null 2>&1; then
    echo "[~] $agent: PROCESS FOUND"
  else
    echo "[-] $agent: NOT FOUND"
  fi
done

# Generate endpoint compliance report
lynis audit system --quick --quiet 2>/dev/null | tail -30
```

### Step 3 — Validate Backup Immutability and Recovery

```bash
# Check backup service status
systemctl status veeam* commvault* bareos* bacula* 2>/dev/null | grep -E "Active:|service"

# Verify backup integrity (example with restic)
restic -r /backup/repo snapshots --latest 5 --json 2>/dev/null | \
  jq '[.[] | {time, hostname, paths, short_id}]'

# Check for S3 Object Lock immutability
aws s3api get-object-lock-configuration --bucket backup-bucket 2>/dev/null | jq '.'
```

### Step 4 — Generate Insurance Readiness Report

```bash
echo "============================================"
echo "  CYBER INSURANCE READINESS ASSESSMENT"
echo "  Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "============================================"
echo ""
echo "1. MFA STATUS"
grep -c "pam_duo\|pam_google\|pam_u2f" /etc/pam.d/* 2>/dev/null || echo "   No MFA modules"
echo ""
echo "2. EDR STATUS"
pgrep -la "falcon\|carbon\|sentinel\|mdatp" 2>/dev/null || echo "   No EDR agents"
echo ""
echo "3. PATCH STATUS"
apt list --upgradable 2>/dev/null | grep -c upgradable || echo "   N/A"
echo ""
echo "4. FIREWALL STATUS"
iptables -L -n 2>/dev/null | head -5 || nft list ruleset 2>/dev/null | head -5
echo ""
echo "5. LOGGING STATUS"
systemctl is-active rsyslog auditd 2>/dev/null | paste - -
```

## Verification

- [ ] MFA enforced on all remote access (VPN, SSH, RDP, admin portals)
- [ ] EDR agent active on 100% of endpoints with prevention mode enabled
- [ ] Backup recovery tested within last 90 days with documented results
- [ ] Incident response plan reviewed and tabletop exercised annually
- [ ] Patch compliance report shows critical CVEs patched within 30 days
- [ ] Insurance readiness report generated and reviewed by CISO quarterly

## References

- NIST CSF 2.0: Cybersecurity Framework
- CIS Controls v8: Implementation Groups 1-3
- Marsh Cyber Insurance Requirements Guide 2025
- Coalition Cyber Insurance Application Checklist
- CISA Cybersecurity Insurance and Ransomware Advisory
