Cyber insurance providers are tightening their requirements for Multi-factor Authentication. For starters, they are being more verbose about the systems and services on which MFA is enabled. They're making what had been a very broad question into a set of discrete questions. Essentially, what was "Do you have MFA enabled?" is now "Do you have MFA enabled on x, y, and z?"