What do cyber insurers require from Australian businesses?

The short answer

Every Australian cyber insurance proposal form now asks some version of the same eight questions. The wording varies between insurers, but the controls don't: multi-factor authentication, endpoint detection and response, backups an attacker can't reach, patching, email security, privileged access, a written incident response plan, and staff training.

Multi-factor authentication comes first on almost every form and is the control most often treated as a condition of cover rather than a factor in the price. Without it, many insurers will decline outright or restrict ransomware cover.

Underwriting has tightened noticeably over the past two years. Questions that used to be a single yes or no — 'do you have backups?' — are now broken into several, each probing a specific weakness.

The dangerous answer isn't 'no'. It's a 'yes' you can't prove. A 'no' gets priced or declined up front. An inaccurate 'yes' can surface after a breach, when the insurer is deciding whether to pay.

What each question is really asking

Below are the controls insurers ask about, what a defensible 'yes' actually requires in a typical Microsoft 365 business, and the gap that most often makes a 'yes' untrue.

Why multi-factor authentication gets asked six ways

Proposal forms increasingly split multi-factor authentication into separate questions by scope — remote access, web email, administrator accounts, and cloud resources including backups — because a business can genuinely have it on some and not others.

That is where a blanket 'yes' goes wrong. Multi-factor authentication switched on for every staff member's email is a real control. It says nothing about the service account a line-of-business application uses to send mail, the admin account created during setup years ago, or the console that manages your backups. Each of those is exactly the kind of account an attacker looks for, precisely because it's the one people forget.

Before answering, list every account that can log in to anything, and check each one. The useful test is not 'do our staff use MFA?' but 'is there any account, anywhere, that can sign in without it?'

Backups: the question that changed the most

Insurers used to ask whether you had backups. Now they ask whether a copy is offline or immutable, whether it's segregated from your main network, and how often a full restore has been tested.

The reason is ransomware. Modern attacks deliberately find and encrypt or delete backups before triggering, so a backup on the same network as everything else tends to be lost alongside it. A copy the attacker can't reach — physically offline, or stored so it can't be altered or deleted for a set period — is what actually lets a business recover without paying.

The restore test matters as much as the backup. A green tick in a backup console confirms that a job ran. It doesn't confirm the right data was captured, or that it can be brought back in a usable state. If a restore has never been tested, the honest answer to that question is no.

The questions that link to the Essential Eight

Insurers increasingly ask about Essential Eight maturity by name, and even where they don't, most of their questions map directly onto it: multi-factor authentication, patching, restricting administrative privileges and regular backups are four of the eight strategies.

That makes the Essential Eight a useful way to prepare. A business that has genuinely reached Maturity Level 1 can answer most of the core questions with evidence rather than optimism. For most Australian small businesses, Level 1 is the sensible target before a renewal.

How to prepare for a renewal

• Get the proposal form early. Underwriters want answers, not a scramble the week cover lapses.
• Answer each question against what is actually configured today, not what's planned or assumed. Where you're unsure, find out rather than guess.
• Gather the evidence as you go: an MFA report showing every account, an endpoint deployment report covering servers, the date and result of your last restore test, your incident response plan, and your training records.
• Close the cheap gaps first. Enforcing multi-factor authentication on a forgotten admin account or moving DMARC towards enforcement costs very little and removes a common reason for a declined claim.
• Where the honest answer is no, say so — and tell your broker what you're doing about it. A disclosed gap with a remediation plan is a pricing conversation. An undisclosed one is a claims dispute.

What this guide is not

This is general information about what Australian cyber insurers commonly ask, not legal or insurance advice. Every insurer's form and policy wording is different, and the obligations around what you must disclose depend on your policy and your circumstances. For your own cover, speak to your broker.