Cyber insurers in Australia increasingly expect evidence that basic security controls are operating before offering cover or responding to a claim. Common requirements include multi-factor authentication, tested backups, endpoint detection, patching, email security and an incident response plan. Meeting these expectations can strengthen an application and reduce disputes over whether policy conditions were satisfied.
What Cyber Insurance Covers, and What It Does Not
Cyber insurance is designed to help organisations manage the financial consequences of a cyber incident. Depending on the policy, this can include costs associated with incident response, forensic investigation, legal advice, data recovery, business interruption, notification, public relations and certain third-party claims.
The exact coverage varies significantly between insurers and policies, so businesses should not assume that every cyber event or recovery cost will automatically be covered.
That distinction matters when assessing cyber insurance.
A policy is not a substitute for security controls. It is a financial risk transfer mechanism that sits alongside the organisation’s broader cyber security programme. Insurers assess the likelihood and potential impact of a claim, and the application process gives them an opportunity to understand how the organisation manages those risks.
The information provided during underwriting therefore matters.
If an organisation states that multi-factor authentication is deployed across privileged accounts, for example, it needs to be confident that this is actually the case. If the application says backups are tested regularly, there should be evidence showing that restoration has been tested rather than simply assuming that backups exist.
This is also relevant when a claim occurs.
Policy wording can contain conditions, exclusions, security requirements and representations that affect how a claim is assessed. An organisation that cannot demonstrate that its stated controls were operating as represented may face questions from its insurer.
Cyber insurance should therefore be treated as one component of a wider risk management strategy, not as protection that allows an organisation to operate without strong preventative and detective controls.
The Controls Insurers Commonly Expect
There is no single checklist that applies to every Australian cyber insurance policy. Requirements vary according to the insurer, industry, organisation size, coverage requested and perceived risk.
However, several controls commonly feature in cyber insurance applications and underwriting discussions.
Multi-Factor Authentication
MFA is one of the most important controls because compromised credentials are frequently used to gain access to cloud services, email, remote access systems and administrative accounts.
Businesses should understand where MFA is deployed and where exceptions exist. It is not enough to say that MFA is enabled if privileged accounts, remote access or critical systems remain outside its coverage.
Tested Backups
Backups can significantly improve an organisation’s ability to recover from ransomware and other destructive incidents.
Insurers may want to understand how backups are protected from unauthorised access, how frequently they are performed and whether restoration has actually been tested.
A backup that cannot be restored when needed is not a reliable recovery control.
Endpoint Detection and Response
Endpoint detection and response, or EDR, provides visibility into activity occurring on endpoints and can help security teams identify malicious behaviour.
For organisations applying for cyber insurance, the important consideration is not simply whether an EDR product has been purchased. Businesses should understand whether it covers the relevant devices, whether alerts are monitored and whether someone is responsible for investigating suspicious activity.
Patch Management
Unpatched internet-facing systems can create significant exposure, particularly when vulnerabilities are actively exploited.
Organisations should maintain an accurate asset inventory, establish patching processes and understand how exceptions are managed. Where critical systems cannot be patched within normal timeframes, compensating controls and documented risk acceptance become important.
Email Security
Email remains a major attack vector for phishing, business email compromise and credential theft.
Organisations should consider controls such as MFA, secure email configuration, phishing-resistant authentication where appropriate, anti-phishing protections and user awareness measures. Domain-level controls such as SPF, DKIM and DMARC can also form part of a broader email security strategy.
Incident Response Planning
Insurers also need to know that an organisation can respond effectively when something goes wrong.
An incident response plan should define responsibilities, escalation procedures, communication channels and decision-making authority. It should also account for external parties such as legal advisers, forensic investigators, insurers and specialist response providers.
The Australian Cyber Security Centre recommends organisations prepare for cyber incidents rather than relying on improvised responses. This aligns with the broader principle that resilience requires the ability to detect, manage and recover from cyber incidents, not simply prevent them.
Why Claims Can Be Reduced or Declined
A common misconception is that purchasing cyber insurance automatically transfers the risk of a cyber incident to the insurer.
It does not.
The organisation still has responsibilities under the policy, and those responsibilities depend on the specific wording and conditions of the contract.
Problems can arise when there is a significant difference between what an organisation represented during underwriting and what was actually operating when the incident occurred.
For example, an organisation may state that MFA protects all remote access, but an investigation could discover that a legacy VPN account was excluded. Another organisation may report that backups are regularly tested but discover during an incident that restoration has not been validated for critical systems.
These discrepancies can create difficult questions during a claim.
Businesses should therefore avoid treating the insurance questionnaire as an administrative formality. Every answer should be accurate, current and supported by evidence.
It is also important to distinguish between having a control and demonstrating that the control works.
A policy may state that backups are performed every day. That does not necessarily demonstrate that the organisation can restore its critical systems within an acceptable timeframe.
Similarly, having an EDR platform installed does not demonstrate that security alerts are being monitored or investigated.
This is where independent security assessments can provide valuable assurance.
How Security Testing Supports Your Application and Renewal
Security testing can help organisations identify gaps before an insurer does.
An independent security risk assessment can evaluate the organisation’s existing controls, identify weaknesses and provide evidence that security risks are being actively managed.
Testing can also identify issues that may otherwise remain hidden.
A vulnerability assessment might identify an unpatched system. A penetration test can determine whether that weakness is actually exploitable and what an attacker could reach after gaining access.
For cyber insurance purposes, this distinction matters because security is not static.
New vulnerabilities, new cloud services, employee changes and infrastructure migrations can all alter an organisation’s risk profile. An assessment performed two years ago may no longer reflect the environment described in a current insurance application.
Security testing should therefore form part of an ongoing risk management programme.
It can also support renewal discussions by giving management a documented view of current security maturity, outstanding risks and remediation progress.
For organisations following the Essential Eight, the Australian Cyber Security Centre describes the framework as a baseline of prioritised mitigation strategies intended to make it harder for adversaries to compromise systems
The Essential Eight is not a cyber insurance policy requirement in itself, and meeting a particular maturity level does not guarantee insurance coverage. However, aligning security controls with recognised Australian guidance can provide a useful structure for identifying and addressing weaknesses.
Aligning Insurance Requirements With the Essential Eight
The Essential Eight provides a practical framework for strengthening several controls that may also be relevant to cyber insurance underwriting.
For example, multi-factor authentication addresses account compromise risk, while patching applications and operating systems helps reduce exposure to known vulnerabilities. Restricting administrative privileges limits the potential impact of compromised accounts, while regular backups support recovery from destructive attacks.
The ACSC’s current guidance identifies these mitigation strategies as a baseline for organisations and provides an assessment process for evaluating implementation.
The relationship is therefore complementary.
An organisation should not implement the Essential Eight simply to satisfy an insurer. It should use the framework to strengthen its underlying security posture, then use independent assessment and documentation to demonstrate how those controls operate.
This approach also makes it easier to identify exceptions.
If a legacy application cannot support MFA, for example, the organisation can document the exception, assess the associated risk and implement compensating controls rather than simply claiming that MFA is universally enabled.
Preparing for the Cyber Insurance Questionnaire and Renewal
The best time to discover a gap in your security controls is before submitting the application.
Before an application or renewal, organisations should review the information they intend to provide and confirm that the answers reflect the current environment.
A practical preparation process should include:
- Review MFA coverage across users, administrators and remote access.
- Confirm which endpoints are protected by EDR.
- Verify that critical vulnerabilities are being patched within defined timeframes.
- Test backup restoration rather than simply checking backup completion.
- Review email security controls and privileged accounts.
- Confirm incident response procedures are current.
- Document significant security exceptions.
- Review third-party access and supplier dependencies.
- Conduct an independent security assessment.
- Keep evidence supporting important questionnaire responses.
It is also worth involving the right people.
Cyber insurance should not be completed solely by an IT administrator or procurement team. Security, IT, risk, legal and executive stakeholders may all have information relevant to the application.
For regulated organisations, cyber resilience is also increasingly part of broader governance expectations. ASIC, for example, emphasises active, continuous and proportionate management of cyber risk and notes that cyber resilience involves the ability to detect, manage and recover from incidents.
The same principle applies to insurance: the strongest position is one where the organisation understands its risks, has appropriate controls in place and can demonstrate that those controls are operating.
Frequently Asked Questions
What do cyber insurers require in Australia?
Requirements vary by insurer and policy, but applications commonly ask about controls such as multi-factor authentication, tested backups, endpoint detection and response, patch management, email security and incident response. Insurers may also assess privileged access, remote access, third-party risk and the organisation’s ability to recover from a cyber incident.
Why would a cyber insurance claim be declined?
A claim may be affected by policy exclusions, conditions or inaccurate representations made during underwriting. Examples can include materially misrepresenting security controls, failing to meet specific policy requirements or leaving known vulnerabilities unaddressed. The outcome depends on the individual policy wording and circumstances of the incident.
Does cyber insurance replace security controls?
No. Cyber insurance transfers some financial risk but does not prevent attacks or replace security controls. Insurers generally expect organisations to maintain appropriate security measures before providing cover. Strong controls such as MFA, backups, EDR, patching and incident response planning remain essential for reducing both cyber risk and potential business disruption.
How can I lower my cyber insurance premium?
There is no guaranteed premium reduction from implementing a particular control. However, demonstrating stronger security maturity can support underwriting discussions. Organisations should maintain MFA, tested backups, EDR, patch management and incident response capabilities, address identified vulnerabilities and retain evidence showing that important controls are operating effectively.
How Intrix Can Help
Cyber insurance works best when it forms part of a broader risk management strategy. Organisations should be able to demonstrate not only that security controls exist, but that they understand their effectiveness, limitations and remaining risks.
Intrix provides independent Security Risk Assessments to help Australian organisations identify security gaps, evaluate existing controls and prioritise remediation. The assessment can provide management with a clearer picture of the risks that may need to be addressed before an insurance application or renewal.
Intrix also helps organisations strengthen their alignment with the Essential Eight Assessment and Implementation, including identifying gaps between documented controls and their actual implementation.
The objective is not simply to satisfy an insurance questionnaire. It is to build a security posture that reduces the likelihood of an incident, improves resilience when an incident occurs and gives the organisation defensible evidence of how cyber risk is being managed.
For organisations reviewing their cyber insurance requirements, independent security testing before renewal can be a practical way to identify issues early, address them systematically and enter the underwriting process with greater confidence.
