Top CybersecurityControls Required
to Secure Cyber
Insurance and HowSophos Can Help
Cyber insurance providers increasingly require organizations todeploy strong cybersecurity controls as a condition of providing
cover. Strengthening your defenses reduces your risk of making
a claim following a major cyber incident, while incident response
planning and testing reduces the cost and impact of an attack.
This table details the top cybersecurity controls that are commonly
considered key to insurability, mitigation, and resilience by cyber
insurance providers, and how Sophos can help. Without a positive
response in the first five categories, organizations may not be able
to secure coverage.

A Sophos Solution Brief. February 2022

Top Cybersecurity Controls Required to Secure Cyber Insurance and How Sophos Can Help
Cyber Control

Multifactor authentication
for remote access andadmin/privileged controls

Endpoint Detection andResponse (EDR)

How Sophos Can Help
Sophos ZTNA

Enables MFA to access your applications from any location.

Sophos Firewall

Supports MFA for remote access VPN.

Sophos Cloud Optix

Monitors AWS, Azure and GCP accounts for Root user and IAMuser access with MFA disabled and provides guided remediation.

Sophos Central

Enforces MFA for your IT security management,securing access to all your protection solutions.

Sophos XDR (ExtendedDetection and Response)

Enables organizations to conduct advanced threat
hunting and neutralization. Detections can come fromall over your environment: endpoint, server, firewall,email, cloud, mobile, Microsoft 365, and more.

Sophos MDR (ManagedDetection and Response)

24/7/365 threat hunting, detection and response deliveredby an expert team as a fully-managed service.

Sophos Workload ProtectionSecures backups in cloud and on premises environments.

Sophos Cloud Optix

Monitors AWS, Azure and GCP accounts for cloudstorage services without backup schedules
enabled and provides guided remediation.

Sophos Cloud Optix

Enables IT teams to manage the large number ofconfigurations and policies in a cloud environment,providing superior visibility, governance, compliance, andoversight of cloud IAM role entitlements, whether human or
non-human cloud services and, ultimately, achieve a stateof least privilege access across their cloud environments.

Sophos XDR (ExtendedDetection and Response)

Records all user activity, including authentication andMicrosoft 365 audit logs to show changes to privilege
settings. Also includes access to the Windows logs fromthe device and domain controller to see Windows events.

Sophos Endpoint andSophos Workload Protection

Prevents attempts to harvest or steal user
credentials directly from memory.

Sophos EmailRemoves malware, malicious URLs, credential harvesting,and impersonation attacks while keeping mail flowing.

Secured, encrypted,
and tested backups

Privileged accessmanagement (PAM)

Sophos Endpoint andSophos Workload Protection
Email filtering andweb security

Cyber incident response
planning and testing

DetailProtects against malicious downloads and suspicious payloads
delivered via browsers. Control features enable administrators
to warn or block websites based on their category, blockrisky file types, and apply data leakage controls against webbased email and file sharing. Web Control for Cloud Workload
environments secures data when users access virtual
desktops that don’t sit behind a traditional web gateway.

Sophos Firewall

Protects from compromised sites, pharming attacks,and malicious downloads with extensive machinelearning and sandboxing inspection for file downloads.
Integrated email protection also provides anti-spam,anti-virus, encryption, and DLP message protection.

Sophos Rapid Response

Provides lightning fast, 24/7 incident responsedelivered by Sophos specialists.

Sophos MDR (ManagedDetection and Response)

Provides 24/7 threat hunting, detection and responsedelivered by an expert team as a fully-managed service.

A Sophos Solution Brief. February 2022

2

Top Cybersecurity Controls Required to Secure Cyber Insurance and How Sophos Can Help
Cyber Control

Cybersecurity awarenesstraining and phishing testing

Hardening techniques,
including Remote Desktop
Protocol (RDP) mitigation

Logging and monitoring/
network protections

End of life systems
replaced or protected

How Sophos Can Help

DetailSophos Phish Threat

Improves security awareness and educates users
with phishing attack simulations, automated security
awareness training, and comprehensive reporting.
Integration with Sophos Email enables security teams to efficiently
identify and fast track the training of users who have been
warned or blocked from visiting a website due to its risk profile.

Sophos FirewallEnables IT teams to easily manage and lock down RDP.

Sophos Cloud Optix

Proactively identifies exposed RDP ports via public cloudsecurity benchmark assessments. Guided remediation instructs
administrators on how to address these security misconfigurations.

Sophos XDR (ExtendedDetection and Response)

Monitors all RDP connections and logs the activity. Remoteterminal allows administrators to enable/disable RDP policy.
Provides visibility into the RDP policy on all
managed devices and detect changes to it.

Sophos XDR (ExtendedDetection and Response)

Records up to 90 days of on-disk data and 30 daysof data stored in the Sophos Data Lake.

Sophos Cloud Optix

Continually monitors public cloud resources to proactively identify
unsanctioned activity, vulnerabilities, and misconfigurations.

Sophos Firewall

Includes extensive built-in logging and reporting included at noextra charge. Additional centralized cloud-based logging andmonitoring is also available, as well as Sophos XDR and Sophos MDR
integration for advanced cross estate threat hunting and response.

Sophos XDR (ExtendedDetection and Response)

Identifies outdated and unsupported software and systems.

Sophos Cloud Optix

Proactively identifies and mitigates security vulnerabilities
and network access misconfigurations in AWS public
cloud environments with integration to Amazon Inspector,
including virtual machine ports exposed to the internet,
remote root login being enabled, or vulnerable software
versions installed. Receives patch status for Amazon virtualmachines with integration to AWS Systems Manager.
Extends vulnerability scanning to cloud native
containers across Azure, AWS and Docker by scanning
container images for OS vulnerabilities.
Automatically detects security configuration vulnerabilities
pre-deployment with infrastructure-as-code template scanningin development pipelines, including scans for embedded
secrets, passwords, and keys to proactively prevent breaches.

Sophos XDR (ExtendedDetection and Response)

Provides access to all applications on the device, version info,
SHA256, patch info and their logs, including the application
execution history, network connections, parent/child processes
etc.. Includes queries to check installed applications against
online vulnerability information, and queries to identify
security posture weaknesses in registry settings.

Patch management andvulnerability management

To discuss how Sophos can help you put in place the cyber controls required by insurance providers,
speak to a Sophos representative.

© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-07-10 (SB-PS)