12 controls your insurer will require

Multi-factor authentication (MFA) on email and all remote access.

Isolated, encrypted, regularly tested backups.

Endpoint detection and response (EDR).

Patches applied quickly, workstations, servers and applications.

Email filtering and anti-phishing protection.

Privileged access management on a least-privilege basis.

A written, tested incident response plan.

Documented employee awareness training.

Logging and monitoring of security events.

Encryption of sensitive data, at rest and in transit.

An inventory of assets and personal information held.

An incident log and notification procedure (Law 25).