Cyber insurance requirements in Australia for small business

Getting cyber insurance as a small business used to mean paying a premium. Now it means filling in a questionnaire, and the questions have teeth. How you answer on your security controls commonly affects whether cover is offered, what it costs and what gets excluded. Here's what Australian insurers typically ask, and how to walk in prepared.

One thing this article is not: insurance advice. Every insurer sets its own underwriting criteria, and your broker is the right person to interpret them for your situation. What follows describes patterns commonly seen in the Australian market.

Why the questions got harder

Insurers price risk. Years of ransomware claims showed them exactly which missing controls turn an incident into a large payout: no multi-factor authentication on email, backups the attacker could delete, and software left unpatched for too long. Claims grew, so underwriting tightened. For a small business that boils down to one thing. Your security posture is now part of your application.

The controls that come up most

Every questionnaire is a bit different. A handful of controls show up on almost all of them.

Multi-factor authentication (MFA)

This is the most common question by a long way. Insurers typically ask whether MFA is enforced on email accounts, remote access and administrator accounts. Many treat MFA on email and remote access as a practical minimum for offering cover at all, because stolen passwords are still the most common way attackers get in. See multi-factor authentication for small business for what the Essential Eight expects at each maturity level.

Backups: protected and tested

It's not just "do you back up?" It's the follow-ups that matter in a ransomware incident. Are backups kept somewhere an attacker holding your admin password couldn't delete them? And have you actually tested a restore? An untested backup is a hope, not a control. See regular backups for what good looks like.

Patching cadence

How quickly do security updates get applied to operating systems and applications? Is anything in the business running software the vendor no longer supports? "Within 48 hours for critical fixes" and "within two weeks generally" are the sort of timeframes underwriters like to see. They mirror the ASD's Essential Eight baselines.

Administrative access

Are admin rights limited to the people who need them? Do admins use separate accounts for everyday work? A compromised all-purpose admin account is how a small incident becomes a total one.

The rest of the Essential Eight

Past those four, questionnaires increasingly reference the Essential Eight as a whole (macro restrictions, application hardening, application control), especially for larger policies. Some insurers just ask for your maturity level outright.

The detail shifts a little by industry. See cyber insurance for trades for how the same questions play out when the "office" is a phone and a ute, or cyber insurance for medical clinics for the added Privacy Act stakes around patient records.

How to prepare for an application or renewal

1. Assess before they ask. Go through the eight controls honestly before the questionnaire lands. The free self-assessment gives you an indicative Level 0–3 per control in about 20 minutes.
2. Fix the answers you wouldn't want to give. "No MFA on email" is the answer most likely to cause problems. It's usually the cheapest to fix, too. Untested backups come a close second.
3. Answer accurately. Always. An optimistic answer isn't a shortcut. If a claim investigation later finds a control you attested to wasn't in place, that can put the claim itself at risk. Accurate answers, even imperfect ones, are the only safe kind.
4. Bring documentation. Written security policies and a summary of where your controls stand make the conversation with your broker concrete. Larger customers ask for the same things.
5. Re-check before each renewal. Controls drift over a year. A quick re-assessment before renewal keeps your answers current and your paperwork honest.

What preparation realistically buys you

Businesses that can clearly show their controls generally have an easier run through underwriting. Fewer follow-up questions, fewer surprises at renewal, a stronger footing when premiums come up. Nobody can promise you a specific discount (pricing is the insurer's call). But turning up with documented answers beats making it up on the form, every time.

Know your answers before the questionnaire arrives: take the free Essential Eight self-assessment. 20 minutes, plain English, no account needed.