It's Monday morning. One of your clients forwards an email with a familiar subject line and an unfamiliar level of detail: their cyber-insurance renewal questionnaire. Forty-some questions this year, up from a dozen. Their insurer needs to know exactly which applications enforce multi-factor authentication and with which factors. It asks how administrative access is scoped and who holds it. It asks whether anyone who left the company in the last year still has an active account anywhere. And it's due Friday.
You've done this before and know where most of the answers live: there are some in the Microsoft admin center, some in a sign-in log, some in a spreadsheet a technician started maintaining eighteen months ago and mostly kept current. You block out the afternoon, then the next morning, then part of Wednesday. By the time you've assembled defensible answers for one client, you've spent the better part of a day. And business is booming you know you can reasonably anticipate 11 more renewal support requests from different clients this quarter.
The cyber-insurance renewal questionnaire has become a recurring compliance deadline, and answering it well is now an identity exercise from top to bottom. Almost every question comes back to the same three things: who can access what, what is used to authenticate, and whether you can prove both. Fortunately, if you get your identity layer right, the questionnaire isn’t a fire drill or migraine—it’s a reliable service you can efficiently deliver again and again.
Demand is driven by the threat environment
More sophisticated AI-powered voice and image cloning mean phishing attempts are increasingly indistinguishable from legitimate communications. Bots continually hunt down exposed credentials at machine speed. It’s easier to engineer convincing attacks, the volume of attempts has skyrocketed, and the targets skew heavily toward the small and midsize businesses (SMBs) that MSPs serve—precisely because they frequently have real data but thin security. And credentials remain central to how those attacks unfold: in Verizon's 2026 Data Breach Investigations Report, stolen credentials were still the top action in web-application attacks—compromised in 52% of breaches in that pattern—and continue to determine how far an intrusion can spread once an attacker is inside.
Cyber-insurance is increasingly a must-have, with pressure coming from two directions. More SMBs are buying coverage because a customer, a lender, or a regulator now requires it—or simply because they don’t want to risk their business and livelihood. And insurers, watching loss ratios climb, are tightening what they demand before they'll write or renew a policy. The questionnaire that asked "do you have MFA?" three years ago now asks whether MFA is enforced on every application, whether privileged accounts use phishing-resistant factors, how quickly departed users lose access, and whether you retain the logs to show it.
For MSPs, that convergence is an opportunity disguised as a chore. Your clients increasingly have to carry coverage, they have to pass the questionnaire to get it, and most of them have no idea how to complete the paperwork. The MSP that can both protect clients properly and shepherd them through underwriting becomes something more valuable than a help desk. It becomes the reason the policy gets approved—and the reason the client stays.
Why the questionnaire eats your week
The problem isn't always that the controls are missing; it's that the evidence is scattered.
In a typical Microsoft-centric SMB, the proof an underwriter wants is spread across several places that don't talk to each other. Sign-in activity lives in one console, directory audit events in another, and each SaaS application outside the Microsoft estate keeps its own separate record—if it keeps one you can reach at all. Default log retention is often shorter than the period the questionnaire asks you to attest to, so the evidence may have aged out before you go looking (unless you’ve set up extensive automated archiving). And while Microsoft can enforce MFA at the org level through Conditional Access, applying granular policies, and proving exactly which policy covers which specific access scenario, is where the real work begins.
Then there's the consistency problem. Whether a given tenant is configured tightly often depends on which engineer stood it up and when. Multiply that across a book of 30 or 80 clients and "how do you enforce MFA?" has 30 or 80 slightly different answers, each of which you have to reconstruct by hand. This isn't to knock Microsoft Entra ID as a product. It's a reflection of what it's like to assemble audit-grade evidence across many tenants from tooling designed to manage one. (We go deep on this subject in our Okta vs. Microsoft Entra ID comparison.)
Even a few hours per client, per renewal cycle, is a realistic number for MSPs doing this the manual way. It's awkward to price cleanly because it’s too irregular to fold neatly into a fixed monthly fee—but it can easily seen as expensive when it shows up as a line item—so it often gets absorbed into the managed-services agreement. Requests like this often land unpredictably and pull senior people off higher-value work at exactly the moment a customer is anxious and watching closely.
The three things that let you answer any questionnaire fast
Almost every renewal questionnaire can be answered quickly if three conditions are true. Each one is an identity design choice you can make once and benefit from on every renewal thereafter.
One: MFA is enforced everywhere, not just where it was convenient to set up.
The questionnaire doesn't ask whether MFA is available; it asks whether it's enforced, on which apps, with which factors. When identity runs through Okta, adaptive MFA can be applied across the full catalog of more than 8,000 pre-built app integrations. You can set a phishing-resistant standard using Okta FastPass, biometrics, possession-based factors, and then apply it universally or scope it by group, app, or risk—with far more granularity than Conditional Access policies allow.
This is where ZeroTek shortens the road for MSPs adopting Okta. Our best-practice baseline for MSPs is detailed and field-tested: out of the box, it protects every user behind phishing-resistant MFA and enforces it wherever access runs through Okta, so a new client is covered across the board from day one. That gives you a strong, secure foundation to customize and build your IAM offering on—as far as you want to take it, or as far as a client's requirements demand. "Every application enforces MFA, and here are the factors" becomes easy to prove.
Two: the evidence lives in one place you can export in a click.
Okta writes authentication, authorization, and administrative events to a single System Log. ZeroTek pulls that log data into our Log Viewer, tailored for MSPs who need to view, search, and filter activities across all clients, then export the exact slice an underwriter asked for, without stitching together records from a handful of different logs and consoles. ZeroTek's own auditing adds a second layer that's increasingly relevant to insurers and assessors: a cross-tenant record of what your technicians did, in which client, and when. Because your technicians work through their own identities rather than shared credentials, every action ties back to a named person—the kind of audit trail and traceability auditors and underwriters increasingly expect.
Three: every client baseline is configured the same way, so the answer has the same shape every time.
This is the difference between answering a questionnaire and reconstructing an environment before you can answer it. When a security baseline is templated and applied at setup—a task easily performed in ZeroTek with ZeroConfig—then core MFA policies, session rules, and admin controls look the same across your whole book, and drift away from that baseline is something you can detect rather than discover during an audit. We'll dig into ZeroConfig as continuous compliance evidence in a subsequent post; for cyber-insurance renewals, the point is simply that consistency can help turn eighty bespoke answers into one repeatable one.
Proof from MSPs already doing this
None of this is theoretical. It's how security-first MSPs run.
Red Cup IT, a California MSP serving finance, healthcare, and B2B SaaS clients—precisely the regulated environments where questionnaires bite hardest—evaluated every major identity provider before standardizing on Okta through ZeroTek. Today they run more than 700 SaaS applications behind Okta across their client base, with passwordless authentication as the default. The operational payoff shows up in the numbers that also happen to be the numbers underwriters care about: password reset tickets down roughly 95%, Microsoft account lockouts down roughly 99%. Founder and CEO Dan Le notes that Okta's policies are more granular and easier to configure than Microsoft Conditional Access, and that ZeroTek lets his team automate and deploy those policies at scale for "a big reduction in administrative overhead," in his words, and a direct answer to the consistency problem that makes renewals painful.
New England Network Solutions (NENS) shows what the same foundation does under real pressure. A prospect called mid-breach; using ZeroTek, NENS stood up an Okta org, integrated Microsoft 365, provisioned users, and secured the company's email within hours. The breach was contained by end of day, and the prospect became a client. The stack that answers the questionnaire easily and efficiently is the same stack that contains the incident the questionnaire is trying to insure against.
There's an epilogue to the NENS story. In November 2025, they were acquired by Harbor IT—the largest of Harbor's eight acquisitions to date—specifically to strengthen Harbor's healthcare and regulatory-compliance capabilities. A mature identity and compliance capability isn't just operational hygiene and growth fuel. A disciplined, security-led, compliance-fluent practice is reflected in a MSP’s valuation.
From fire drill to service line
Here's the shift in framing that matters for people who own the numbers and the architecture at your MSP.
Renewal questionnaires are recurring and increasingly frequent. Your clients can't opt out of them if they want cyber insurance, and most can't answer them alone. That's the definition of a service worth paying for. When your identity layer is built to produce evidence on demand, "cyber-insurance readiness" becomes a defined, repeatable offering—attestation support, evidence packages, an annual controls review—rather than unbudgeted hours you absorb because a client is stuck. The same foundation underwrites a broader compliance practice, because the controls insurers ask about are the controls HIPAA, SOC 2, PCI DSS, FTC Safeguards, and other regulations ask about too.
The competitive angle is just as real. When a prospect's current MSP takes a week to produce shaky answers and yours produces clean ones in an afternoon, you haven't just saved time. You've demonstrated, in the moment a client is most concerned, exactly why they should be working with you. You’ve given them a reason to stay that renews every single year.
The next questionnaire is already on its way
Another renewal lands next quarter, and the only real question is what it costs you: days of assembling evidence by hand from consoles that were never designed to be read together, or a clean export from an identity platform built to produce it on demand across every client you manage. The threats aren't easing and neither is the underwriting. The MSPs who treat identity as the foundation of compliance, not an afterthought to it, are the ones who'll turn a rising tide of questionnaires into a rising line of revenue.
See how ZeroTek helps you deliver Okta as the backbone of a compliance practice. Book a 30-minute walkthrough. No pressure tactics. No salespeople.