Security
Renewal questionnaires have become technical. Answering optimistically can void the policy at claim time, so here is what the questions mean.
A cyber renewal five years ago asked whether you had antivirus and a firewall. Today it asks whether multi factor authentication covers remote access, email and privileged accounts specifically, whether backups are immutable or offline, and whether you run endpoint detection and response as distinct from traditional antivirus.
These are warranties, not a survey. An answer that is optimistic rather than accurate gives an insurer grounds to decline at exactly the moment you need the policy. If you are not certain multi factor covers every administrator account, the correct answer is not yes.
Each of these is also the thing that reduces the chance of the claim, which is the point.
More
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
