Prairie Junction is buying cyber insurance. The application asks about MFA, endpoint detection, vendor access, backups, and incident response testing. What should finance do before binding coverage? Management wants a recommendation that would survive public-records review and a later independent audit. The working file estimates $3,710,000 of exposure, a 35-day action window, and a 18% variance from the adopted plan, so staff must separate material facts from noise. A prior staff draft chose the fastest administrative answer, and the finance officer is asked whether that shortcut changes the technically best answer.
