What your cyber insurer is really asking

The IT questions behind a cyber insurance renewal

A renewal form lands in your inbox and asks whether multi-factor authentication is enforced, how backups are protected and how quickly security updates are installed. The deadline is clear. The answers may be less so.

For the owner or office manager completing it, the challenge is often finding the person who can confirm each answer. A little preparation turns that chase into a more useful review of the business.

What the insurer needs to understand

The Insurance Council of Australia’s cyber risk guidance explains the role of prevention alongside insurance. The questions and cover vary between insurers and policies. Treat your own questionnaire as the source of truth and ask your broker to explain anything ambiguous.

Keep the responsibilities clear: the business supplies accurate information, the IT provider explains what is implemented, and the insurer or broker interprets the insurance requirements. A technical review does not guarantee cover or a successful claim.

The questions to take to your IT provider

• Account access: where is MFA enforced, including email, remote access and administrator accounts? Ask for a current coverage report and a list of exceptions. ASD’s MFA guidance is a useful reference for the technical discussion.
• Backups: which business data is covered, who can alter or delete the copies, and when was recovery tested? Ask for backup scope and restore results, not just a schedule.
• Updates: who tracks security fixes for devices and applications, how is urgency decided, and which systems are overdue? Ask for the policy and current status.
• Administrator access: who can change systems, why do they need that permission, and when was access reviewed? Include supplier and service accounts.
• Device protection: which computers and servers are covered, and who reviews alerts? Ask for an inventory and the escalation process.

These questions connect directly to Cicom’s security services and backup and data recovery. They also overlap with our plain English Essential Eight guide, although an insurer may ask for controls beyond that framework.

Include people and incident readiness

A policy or training course is only part of the answer. Check who has completed training, how staff verify changed payment details and where they report suspicious activity. Give staff an example they can recognise, such as a supplier email requesting a new bank account.

For incident response, keep a usable contact list and agree who can make decisions. ASD’s incident response guidance for leaders is a useful starting point. Your plan should cover the IT provider, business decision maker, broker and insurer, with an offline copy available if email is inaccessible.

ReportCyber provides a reporting route for cybercrime and incidents. It does not replace your insurer’s notification process. Ask the broker how and when the insurer needs to be contacted and whether nominated response providers must be used.

Build a small evidence folder

Give the renewal a named owner and work backwards from the due date. Start with last year’s form, then record what has changed: new staff, a second site, a new cloud system or a different provider.

• Keep a copy of the current questionnaire and record the scope of each answer.
• Attach dated evidence, including access reports, backup tests and update records.
• List gaps, planned fixes, owners and realistic completion dates.
• Ask the broker how to disclose partial implementation or exceptions.

Store the evidence securely. It may reveal sensitive details about the business’s systems. Use IT governance support to keep policies, responsibilities and records consistent between renewals.

If you cannot confidently tick yes

Do not fill the gap with an assumption. Describe what is implemented and what remains outstanding, then have your broker clarify how to answer. Fixing a control later does not change what was true when the form was completed.

An unsupported answer can create uncertainty during underwriting or after an incident. The consequences depend on the circumstances and policy, so discuss them with your insurer or broker rather than relying on a general article.

Get the technical picture clear before renewal

A renewal is a useful reason to review the environment while there is still time to address gaps. Contact Cicom to discuss your IT setup and arrange a review with the team. Bring the questionnaire so the conversation starts with the questions you need answered. You can also call 1300 324 266.

This article provides general information, not insurance or legal advice. Confirm your policy requirements and cover with your insurer or broker.