EVIDENCE GUIDES

Evidence Collection Guides

Step-by-step export instructions for security platforms. Follow these guides to collect MFA, EDR, backup, and email security evidence that carriers accept.

Not sure which evidence a carrier requires? See our underwriting answers. Need a template to structure your evidence? Browse our evidence templates.

Okta

Export Okta MFA evidence for cyber insurance: MFA Enrollment by User, Authentication Activity, and System Log exports. 90-day retention — collect early.

Multi-Factor AuthenticationIdentity Access ManagementPrivileged Access Management

~30 min

Microsoft 365 / Entra ID

Export Microsoft 365 and Entra ID MFA evidence for cyber insurance. Sign-in logs, Conditional Access, and Security Defaults — what underwriters expect.

Multi-Factor AuthenticationIdentity Access ManagementEmail Security ControlsPrivileged Access Management

~40 min

CrowdStrike Falcon

Export CrowdStrike Falcon EDR evidence for cyber insurance: host coverage, detection data, and Spotlight vulnerabilities. Define your coverage denominator.

Endpoint Detection & ResponsePatch Management Program

~25 min

Google Workspace

Export Google Workspace MFA evidence for cyber insurance. Admin audit logs, Context-Aware Access, and DMARC/SPF/DKIM settings.

Multi-Factor AuthenticationIdentity Access ManagementEmail Security Controls

~25 min

Veeam Backup & Replication

Export Veeam backup evidence for cyber insurance: immutability proof, SureBackup restore verification, and job reports. Follow the 3-2-1-1-0 rule.

Backup & Recovery ProgramBusiness Continuity & Disaster Recovery

~30 min

Cisco Duo

Export Cisco Duo MFA evidence for cyber insurance: authentication logs, user enrollment, and policy scope. 180-day retrieval limit — export early.

Multi-Factor AuthenticationRemote Access & VPN

~20 min

SentinelOne

Export SentinelOne EDR evidence for cyber insurance: endpoint coverage, threat reports, and Deep Visibility telemetry. Detect vs. Protect mode matters.

Endpoint Detection & Response

~25 min

KnowBe4

Export KnowBe4 training evidence for cyber insurance: Training Activity, Phishing Activity, and Phish-prone Percentage reports.

Security Awareness Training

~20 min

Datto RMM

Export Datto RMM patch and device evidence for cyber insurance. Per-client reporting, Windows-only patch scope, and audit-backed inventory.

Patch Management Program

~20 min

ConnectWise Automate

Export ConnectWise Automate patch and inventory evidence for cyber insurance. Per-client reporting via Report Center and Dataviews.

Patch Management Program

~20 min

Automate evidence collection with BindLedger connectors

Create Free Account →