Cyber insurance requirements in Australia for small business

A few years ago, getting cyber insurance as a small business mostly meant paying a premium. Today it means answering a questionnaire — and the questions have teeth. Answers about your security controls commonly affect whether cover is offered, what it costs, and what is excluded. This guide covers what Australian insurers typically ask and how to walk in prepared.

One thing this article is not: insurance advice. Every insurer sets its own underwriting criteria, and your broker is the right person to interpret them for your situation. What follows describes patterns commonly seen in the Australian market.

Why the questions got harder

Insurers price risk, and years of ransomware claims taught them exactly which missing controls turn incidents into large payouts: no multi-factor authentication on email, backups that the attacker could delete, and long-unpatched software. As claims grew, underwriting tightened. The practical result for a small business: your security posture is now part of your application.

The controls that come up most

Questionnaires vary, but a handful of controls appear on almost all of them:

Multi-factor authentication (MFA)

The most common question by far. Insurers typically ask whether MFA is enforced on email accounts, remote access, and administrator accounts. Many treat MFA on email and remote access as a practical minimum for offering cover at all, because stolen passwords remain the most common way attackers get in. See multi-factor authentication for small business for what the Essential Eight expects at each maturity level.

Backups — protected and tested

Not just "do you back up?" but the follow-ups that matter in a ransomware incident: are backups kept where an attacker with your admin password could not delete them, and have you actually tested a restore? An untested backup is a hope, not a control. See regular backups for what good looks like.

Patching cadence

How quickly security updates are applied to operating systems and applications, and whether anything in the business runs software the vendor no longer supports. "Within 48 hours for critical fixes" and "within two weeks generally" are the kinds of timeframes underwriters like to see, mirroring the ASD's Essential Eight baselines.

Administrative access

Whether admin rights are limited to people who need them, and whether admins use separate accounts for everyday work. A compromised all-purpose admin account is how small incidents become total ones.

The rest of the Essential Eight

Beyond those four, questionnaires increasingly reference the Essential Eight as a whole — macro restrictions, application hardening, application control — especially for larger policies. Some insurers ask for your maturity level directly.

How to prepare for an application or renewal

1. Assess before they ask. Run through the eight controls honestly before the questionnaire arrives. The free self-assessment gives you an indicative Level 0–3 per control in about 20 minutes.
2. Fix the answers you wouldn't want to give. "No MFA on email" is the answer most likely to cause problems, and usually the cheapest to fix. Untested backups are a close second.
3. Answer accurately — always. An optimistic answer on a questionnaire is not a shortcut. If a claim investigation later finds a control you attested to wasn't in place, that can jeopardise the claim itself. Accurate answers, even imperfect ones, are the only safe kind.
4. Bring documentation. Written security policies and a summary of your control status make the conversation with your broker concrete, and they're what larger customers ask for too.
5. Re-check before each renewal. Controls drift over a year. A quick re-assessment before renewal keeps your answers current and your documentation honest.

What preparation realistically buys you

Businesses that can clearly demonstrate their controls generally have an easier path through underwriting — fewer follow-up questions, fewer surprises at renewal, and a stronger position in premium conversations. No specific discount can be promised (pricing is the insurer's call), but walking in with documented answers beats improvising on a form, every time.

Know your answers before the questionnaire arrives: take the free Essential Eight self-assessment — 20 minutes, plain English, no account needed.