Corvus Smart Cyber application: the email questions, and how MSPs can answer them

The Corvus Smart Cyber Insurance® Application, Version 3.2 | September 2024, is a 24-question form, and several of the questions are about email. Two ask about filtering and gateways. One asks about MFA on every way staff reach their mailbox. One asks about verifying payment-change requests, which are a classic email fraud. This page describes what the public form asks, using its own wording and glossary. It isn't insurance advice. Corvus decides what an answer means.

About the form

• Form: Smart Cyber Insurance® Application. Every page footer reads "CorvusInsurance.com | Version 3.2 | September 2024."
• Source: a public PDF in Corvus's help center. An identical copy is on corvusinsurance.com's broker hub. The Corvus site now brands itself "Corvus by Travelers."
• Website scan: footnote 1 on Q3a says Corvus "runs a scan on the Applicant's primary corporate website and any affiliated sites" to create its Dynamic Loss Prevention report. High-level results come with the quote, and the full report comes after binding. The form doesn't list what the scan checks, so don't assume it does or doesn't include email DNS records.

The email questions

Q9. Filtering.

> Do you have email filtering in place?

Yes or No. The glossary defines Email Filtering as an "Email security tool used to 'filter out' spam and other malicious content from an organization's inbound and outbound email messages." It adds that filtering "provides average protection against obvious spam emails, but does not protect against more targeted and sophisticated email attacks."

Q9b. Secure Email Gateway.

> Do you use an advanced email security solution that includes features such as URL and attachment sandboxing. (Secure Email Gateway)

If Yes, the applicant names the solution. The glossary says a SEG's "core functionality" includes "URL rewriting, URL and Attachment Sandboxing, impersonation protection for key individuals (CIO/CFO), and clawback ability to remove an email from an inbox if it is determined to be malicious after it has been delivered." Answer Yes only if the product and license the client actually runs have those features switched on, and name it accurately.

Q11c. MFA on email.

> MFA enforced for email access via webmail portal (i.e. Gmail), mailbox applications (i.e. Outlook Application) and non-corporate devices for all employees

This is broader than "MFA on webmail." It covers the browser, desktop and mobile mail apps, and personal devices, for all employees. The glossary says "Modern MFA does not include static authentication methods such as; certificates or pre-shared keys (PSK)."

The rest of Q11 asks about MFA for all remote network access (11a, Yes/No/N/A), internal use of privileged accounts including "administrator accounts, service accounts, etc." (11b), and access to all critical applications (11d).

Q12. Privileged accounts. One of the options to select is: "Administrative users use different accounts for administrative use and non-administrative use (e.g. day to day activities such as web browsing and email)."

Q18. Training. "Do you conduct employee security training or phishing training, for all employees, at least annually?"

Q19. Payment verification.

> Prior to executing an electronic payment, do you verify the validity of the funds transfer request or payment change request, with the requestor, via a separate means of communication prior to transferring funds or making payment changes?

The glossary's Out-of-Band Authentication entry gives an example: "calling a known and trusted phone number to confirm a change in payment instructions sent via email from a vendor."

What the form doesn't ask

Version 3.2 has no question about SPF, DKIM or DMARC. If a client's broker or Corvus asks about them separately, answer from evidence. Don't infer the question from this form.

How an MSP can prepare

1. Q9 / Q9b: write down the filtering product, its license tier, and which of the glossary's SEG features (URL rewriting, sandboxing, impersonation protection, clawback) are actually on. If some aren't, say so. A built-in spam filter is still filtering for Q9, but it may not meet the glossary's description of a SEG for Q9b.
2. Q11c: check sign-in policy coverage for browser, desktop and mobile clients, and for unmanaged devices. List exceptions such as shared mailboxes, service accounts and legacy protocols before anyone signs.
3. Q11b and Q12: confirm admins use separate accounts. Pay particular attention to your own technicians' access to the client.
4. Q10b (backups): one of the options is "MFA required for access to backups." If you run the backup console, that one is yours to confirm.
5. Q19: this is a finance process, not a setting. Ask the client how they handle a vendor's "new bank details" email, and whether that's written down.
6. Domain hygiene: the form doesn't ask about it, but a dated SPF, DKIM and DMARC snapshot is still useful evidence if the underwriter asks follow-up questions.

Who signs

The signature block asks for the applicant's signature, printed name, date, email and title. Footnote 2 says the applicant email is added to Corvus's "CrowBar" platform for risk management advice and alerts. The form doesn't specify which officer must sign.

Document what DNS can show

Run the free insurance email controls check →

It maps public DNS to common email questions (DMARC, SPF, DKIM, filtering) and labels each Verified, Unknown or Not tested, with evidence you can paste. It can't confirm sandboxing features, MFA or payment processes. It's not insurance advice.

Founding Partner: $1,999, one time. Hand clients a branded, dated email security record before their next renewal. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →