Give your insurer independent evidence that your controls work, before renewal or a new application. Testing and audits by CISA-certified auditors, scoped to what your policy asks for.
Cyber insurance applications and renewals now ask detailed questions about your security, and some policies require independent testing before coverage is offered or renewed. Answers you cannot back up can lead to higher premiums or exclusions, and can create problems if you ever need to file a claim. The strongest position is evidence: tested controls and an independent report you can share.
We are independent auditors, not an insurer or broker. We test and document your controls so you can answer the application accurately, close gaps before renewal, and share proof with your insurer or broker.
Applications word these differently, but most come back to the same six questions. For each one, here is the document that answers it and the engagement that produces it.
| The insurer asks | The evidence you hand over | How we produce it |
|---|---|---|
| Do you have your defenses tested by an independent party? | Penetration test report and Auditor Opinion Letter | Cybersecurity audit |
| Are backups isolated from your network, immutable, and tested? | Backup findings with measured restore times | Ransomware readiness audit |
| Is multi-factor authentication enforced for email and remote access? | Microsoft 365 configuration review | Microsoft 365 security audit |
| Do employees receive phishing and security awareness training? | Phishing simulation results | Social engineering assessment |
| Do you have a tested incident response plan? | Incident response plan review | Ransomware readiness audit |
| How mature is your security program overall? | NIST CSF 2.0 maturity score | NIST CSF 2.0 assessment |
One engagement rarely needs all six. We read your application first and scope only the testing your insurer will actually ask to see.
Many insurers ask for independent penetration testing. Our cybersecurity audit tests your prevention, detection, and response the way a real attacker would, and the report documents what was tested and what was found.
Cybersecurity auditInsurers look closely at backups because they decide whether a ransomware attack is an outage or a disaster. We verify that backups are isolated and immutable, measure real recovery times, and review the cyber insurance conditions you are required to meet.
Ransomware readiness auditMulti-factor authentication and email security are among the most common insurance questions, and for most organizations both live in Microsoft 365. We review Entra ID, conditional access, and email security so your answers hold up.
Microsoft 365 security auditPhishing is a common way attacks begin, and insurers want to know your people are prepared. Phishing simulations, vishing, and pretexting show how your staff actually respond and where training is needed.
Social engineering assessmentAs Certified Information Systems Auditors, we are authorized to issue formal audit opinions. Our Auditor Opinion Letter documents your audit results in a form you can share with your insurer or broker, as independent proof of testing.
Auditor Opinion LetterWhen an insurer wants the overall picture, NIST CSF is the framework most often used. Our Reviewed Assessment is built for a board, an insurer, or a customer questionnaire: a certified auditor reviews the evidence behind all 106 CSF 2.0 subcategories, and a full audit ends with our independent opinion.
NIST CSF assessmentEvery insurer and every policy asks for something different, and so does every network. We do not sell a fixed package. We start with what your application or renewal requires, test what you actually run, and deliver evidence that is specific and actionable.
We start from your application, renewal questions, or policy conditions, and focus testing on what your insurer actually asks about.
Findings are mapped to frameworks insurers and clients already recognize, such as NIST and ISO 27001, so the audit doubles as evidence.
Reports and an Auditor Opinion Letter you can attach to an application or send to your broker, with the technical detail kept separate.
Insurers now treat cybersecurity as part of underwriting. Applications ask about penetration testing, backups, multi-factor authentication, and incident response, and some policies make independent testing a condition of coverage. Our role is to test the controls your insurer cares about, help you close the gaps before renewal, and give you independent documentation that backs up every answer. Our cybersecurity audit and penetration test is where most organizations start.
We start with your application or renewal questionnaire and mark each question that needs proof. A penetration test, a backup and recovery test, and a Microsoft 365 review cover most of them; the rest we scope only if your insurer asks. You receive a risk-rated report mapped to NIST and ISO 27001, an Auditor Opinion Letter you can share with your insurer or broker, and, once gaps are closed, proof of remediation. Our support continues for three months after delivery.
Most organizations begin with one engagement and build from there. Find the situation closest to yours:
Not sure? A free consultation will help you decide.
Altius IT has performed independent security audits for over 30 years. Because we are auditors, not an insurer or a security product vendor, our findings are independent and our reports carry the weight of a Certified Information Systems Auditor. We tailor every engagement to your policy, your environment, and your timeline.
No. We are independent auditors, not an insurer or broker. We test and document your security controls so you can answer applications accurately and give your insurer or broker independent evidence.
We cannot promise pricing; underwriting decisions belong to your insurer. What an independent audit gives you is accurate answers, gaps closed before renewal, and documented evidence of your controls, which puts you in a stronger position for that conversation.
As early as you can. Starting well before your renewal date leaves time to fix what the testing finds and to document the fixes. If your renewal is close, tell us the date and we will scope the work to what matters most for it.
Every engagement is customized. Explore other common needs, or see what we recommend for your industry.
