Cyber insurance used to be a form and a credit card. It is not any more. Insurers have paid out enough claims to know exactly which missing controls cause them, and they now ask hard questions before they quote. This guide gets you ready.
- Insurers now expect real controls in place before they quote, and they check. The application is a legal document, so every answer must be true.
- The near-universal baseline is multi-factor authentication, tested backups, endpoint detection, prompt patching and staff training.
- Most of the questionnaire overlaps the Essential Eight, so the same work that satisfies insurers also improves your actual security.
Why insurers got strict
For years, cyber cover was cheap and easy because insurers did not yet understand the risk. Then the claims arrived, and a pattern emerged: the expensive incidents almost always traced back to a short list of missing controls. So insurers turned that list into a questionnaire, and the questionnaire into the price of entry.
That is good news, oddly. The controls insurers demand are the same controls that stop the incident in the first place. Getting insurable and getting secure are now almost the same project.
The controls insurers commonly require
Requirements differ by insurer and by the size of the policy, but this is the baseline that appears again and again on Australian questionnaires.
How much each control moves the needle
Not every control carries equal weight on an application. A rough sense of how often each is treated as a hard requirement versus a nice-to-have:
The answers have to be true
The application is a legal document. If you attest to a control you do not actually have, and a claim later traces back to that exact gap, the insurer can reduce or decline the payout. That is the worst possible time to discover a form was optimistic.
So the honest answer is always the safer one. If a control is not in place, the right move is to put it in place, not to tick the box and hope. That is also why a genuine assessment before you apply is worth so much: it turns guesses into facts you can attest to with confidence.
The overlap with the Essential Eight
If this list feels familiar, it should. Most of it maps directly onto the ASD Essential Eight: multi-factor authentication, patching, backups and restricting administrative privileges are on both. Working toward the Essential Eight puts most of the insurance answers in place at the same time, and it is the same baseline that keeps you out of the notifiable data breach process.
Getting ready before you apply
Cyber insurance is a backstop, not a strategy. The controls are what actually protect you; the policy is what helps you recover when something still gets through. We help Australian businesses get both in order, and we can map you against a typical insurer questionnaire so you know exactly where you stand. Start a conversation.
This article is general information, not financial or legal advice. Requirements vary between insurers and policies, so always read your own questionnaire and policy wording, or speak to a licensed broker.
