A new supplier has remote access: does your Cyber request still describe the business?

Describe the relationship without exposing keys

Fictional example: a business hires outside support for its invoicing software. The provider receives remote maintenance access. The manager records the purpose, systems and internal service owner without copying passwords, access codes or customer lists into an insurance request.

Make a simple map: service, access type, internal responsible person and questions still requiring technical clarification. Distinguish active access from permissions merely planned. Do not guess technical controls to answer a question; ask the responsible person to confirm the actual arrangement. A concise description should explain the relationship without revealing the information needed to exploit it.

Separate the IT agreement from insurance

AIG presents CyberEdge with incident-response components and states that its contract is subject to terms, limits and exclusions. That presentation does not decide how a particular quotation treats an incident associated with an outside provider. Scope must be clarified through the applicable documentation.

Ask the intermediary what information about the external relationship is required and how third-party dependencies and access are considered. A provider’s support commitment is not an insurer’s confirmation. Resolve technical uncertainty with the competent team before declaring controls implemented or describing the access as secure.

Sources: AIG Portugal — CyberEdge, resposta e termos aplicáveis; consultado 20/10/2026 ↗

Compare the recorded description with today’s position

Identify when the provider joined, its purpose and relevant systems without presenting the map as a security audit. Ask whether the change requires updated answers or quotation documents. Do not assume sending a note automatically amends the contract.

Keep the response reference and identify who verifies technical information. If the provider leaves, ask the responsible team to check access under company procedures; do not make technical changes solely because of this article. Insurance review does not replace security management or guarantee prevention. Keep any unresolved answer visible rather than treating the review as completed.

Supply sufficient information through a protected channel

For new assessment in Portugal, read the Cyber guide on rmachado.group and select that branch. Explain the activity and operational change through the indicated flow. Do not share credentials, sensitive configurations, customer information or complete records in comments. For an existing incident, use contractual response and reporting channels rather than waiting for renewal.