What edition is the Travelers MFA supplement?

The public form is CYB-14306 Rev. 03-23, Multi-Factor Authentication Supplement, from Travelers Casualty and Surety Company of America.

Does the Travelers MFA supplement ask about DMARC or SPF?

No. CYB-14306 Rev. 03-23 covers only MFA: email, remote network access, administrative access, and whether the signer had IT security's help.

What happens if we answer "No"?

The form says any "No" answer must be explained in the Additional Information section at the end of the application. How Travelers treats the answer is up to its underwriting.

Who should sign the Travelers supplement?

The signature section is for the applicant's "Executive Officer," who represents the answers are true and complete "after reasonable inquiry." Question 4 asks whether that signer had "the assistance of the person in charge of IT security."

Travelers' MFA supplement: the email and admin questions MSPs end up answering

Map a domain to insurance email questions →This article is a how-to. The matching tool checks a live domain.

Travelers' Multi-Factor Authentication Supplement, form CYB-14306 Rev. 03-23, is short: four questions over three pages, most of it fraud notices and signatures. Its first question is about email, and the rest are the kind of thing only the client's IT provider can answer accurately. This page describes what the public form asks, in its own words. It isn't insurance advice. The form and the underwriter decide what an answer means for coverage.

About the form

Form: Travelers Casualty and Surety Company of America, Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23. The footer on page 1 also carries "© 2023 The Travelers Indemnity Company."
Source: a public PDF on Travelers' asset server (trvstatic.com).
Format: each question is a statement that the applicant marks Yes or No. For example, "Multi-Factor authentication is required for all employees…" The word "required" here describes the applicant's own policy. The question is whether the applicant requires MFA. It's not a statement that Travelers requires it.
"No" answers: the form says, "For any 'No' answers, provide an explanation in the Additional Information section provided at the end of this Application."

How the form explains MFA

Before the questions, the supplement defines MFA as "two or more means of identification and access control," meaning something you know, something you have, or something you are. It says MFA "is successfully enabled when at least two of these categories of identification are required." It gives an SMS code as an example of "something you have."

It then explains each area. On email:

> Requiring multi-factor authentication for remote access to email can help reduce the potential for a compromise to corporate email accounts caused by lost or stolen passwords. Without this control an intruder can easily gain access to a user's corporate email account.

It adds that threat actors "often use this access to perpetrate various cyber crime schemes against the impacted organization and its clients and customers."

The questions

1. Email.

> Multi-Factor authentication is required for all employees when accessing email through a website or cloud based service.

Answers: Yes, No, or Email is not web based. For a Microsoft 365 or Google Workspace client, "through a website or cloud based service" describes their email, so the realistic answers are Yes or No. The key words are all employees. A few users exempted from Conditional Access, or a shared mailbox someone can sign into with a password alone, are what to resolve before the client marks Yes.

2. Remote network access.

> Multi-Factor authentication is required for all remote access to the network provided to employees, contractors, and 3rd party service providers.

"3rd party service providers" includes the MSP. If your remote-management or remote-access tooling reaches the client's network without MFA, this question is about you.

3. Administrative access, "in addition to remote access," including access provided to third-party service providers. MFA required for:

(a) "All internal & remote admin access to directory services (active directory, LDAP, etc.)"
(b) "All internal & remote admin access to network backup environments"
(c) "All internal & remote admin access to network infrastructure (firewalls, routers, switches, etc.)"
(d) "All internal & remote admin access to the organization's endpoints/servers"

Each is Yes or No. Note internal as well as remote. Admin MFA that applies only off-site doesn't meet the wording.

4. Who helped answer.

> The signer of this form has done so with the assistance of the person in charge of IT security.

For many small clients, that person is effectively the MSP. A Yes here records that the answers were prepared with IT input. It's another reason to give the signer documented facts, not guesses.

What this supplement doesn't ask

CYB-14306 asks nothing about SPF, DKIM, DMARC, email filtering or gateways. It's entirely about MFA. Email authentication may come up elsewhere in a Travelers submission (the main application, other supplements or underwriting questions), but not on this form. Don't tell a client that this supplement depends on their DMARC policy.

How an MSP can prepare

Email MFA (Q1): export the tenant's MFA or Conditional Access coverage and list any accounts that can sign in without MFA. That includes service accounts, shared mailboxes and legacy-protocol access.
Remote access (Q2): list every remote path into the network: VPN, remote desktop gateways, and your own RMM and remote-support tools. Confirm MFA is enforced on each.
Admin access (Q3a–d): check directory admin roles, backup consoles, firewall and switch management, and server or endpoint admin, both on-site and remote.
Write the explanations for any "No" answers in plain language: what the gap is, what compensating control exists, and when it will be closed. The form asks for these in Additional Information.
Date everything. The signer is attesting to facts as of the application date.
Flag changes. The signature section says the applicant "will notify Travelers of any material changes to the information provided." If MFA coverage changes after signing, tell the client and their broker.

Map the client's email controls

Run the free insurance email controls check →

It maps public DNS to common application email questions (DMARC, SPF, DKIM, inbound filtering) and labels each Verified, Unknown or Not tested, with evidence you can paste. MFA can't be seen from DNS, so it stays Not tested. The Travelers MFA questions need tenant evidence. It's not insurance advice.

Founding Partner: $1,999, one time. Give every client a branded, dated record of their email security before renewal season. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →

FAQ

What edition is the Travelers MFA supplement?: The public form is CYB-14306 Rev. 03-23, Multi-Factor Authentication Supplement, from Travelers Casualty and Surety Company of America.
What does the Travelers supplement ask about email?: Question 1 asks the applicant to answer Yes, No, or "Email is not web based" to: "Multi-Factor authentication is required for all employees when accessing email through a website or cloud based service."
Does the Travelers MFA supplement ask about DMARC or SPF?: No. CYB-14306 Rev. 03-23 covers only MFA: email, remote network access, administrative access, and whether the signer had IT security's help.
What happens if we answer "No"?: The form says any "No" answer must be explained in the Additional Information section at the end of the application. How Travelers treats the answer is up to its underwriting.
Does "3rd party service providers" include the MSP?: The form's wording covers remote and admin access "provided to employees, contractors, and 3rd party service providers," so an MSP's access to the client's network falls within the questions.
Who should sign the Travelers supplement?: The signature section is for the applicant's "Executive Officer," who represents the answers are true and complete "after reasonable inquiry." Question 4 asks whether that signer had "the assistance of the person in charge of IT security."