When you apply for cyber insurance, and again at each renewal, the insurer asks how your IT is set up: where multi-factor authentication (MFA) is enforced, how backups are stored and tested, how quickly patches are applied, and more. The questions differ between insurers, so there is no universal checklist, but the job stays the same. Answer each question honestly, fix what you can before the renewal date, and keep a dated record behind every "yes". Your IT provider can answer the technical questions. Your business is still responsible for every answer, even one your IT provider supplied, and questions about cover or price belong with your broker or insurer.
Computer Support Professionals (CSPRO) is an IT and cybersecurity provider, not an insurer or broker, and this guide is general information, not legal or insurance advice. The rest of this guide walks through what the forms ask, why accurate answers matter, who answers what, the proof to keep for each control, and the order to work in before you sign.
What insurers ask about, and why the questions vary
According to the Insurance Council of Australia, cyber insurance generally includes first-party cover, for your own costs of responding to an incident, and third-party cover, for liabilities to others such as privacy liability and regulatory investigations. To decide whether to accept that risk, and on what terms, insurers ask about your controls on a proposal form.
How much they ask varies widely. Two Australian forms show the range:
- A 2025 broker form from insurance.com.au runs to three pages. Its security questions cover device encryption, where MFA is enforced, how payment and bank detail change requests are verified, and any cyber incidents in the past three years.
- A 2021 underwriter form, Agile Underwriting's CyberSelect proposal form (version 03/21), runs to eleven numbered pages and goes much further, from backup separation and restore testing to patch timing, unsupported systems, leavers' access and staff training. Because it dates from 2021, treat it as an example of the topics insurers ask about, not any insurer's current wording.
There is no single list of cyber insurance requirements that every insurer uses. Start from the form your broker or insurer sends for this application or renewal, because last year's answers may not fit this year's questions.
Why a wrong "yes" can cost you at claim time
Under the Insurance Contracts Act 1984, a business must tell the insurer, before the policy is entered into, every matter it knows of that is relevant to the insurer's decision to accept the risk and on what terms. That includes matters a reasonable person in the business's circumstances could be expected to know are relevant. The Act treats renewing, extending or varying a policy as entering into it, so the duty applies again at each renewal.
If the duty isn't met, or the business gives an untrue answer without reasonable grounds to believe it, the Act allows the insurer to:
- reduce what it pays on a claim to the amount that puts it where it would have been without the failure, which in some cases means refusing the claim;
- avoid the policy from the start, if the failure was fraudulent;
- cancel the policy.
The 2021 form's notice to applicants lists these consequences. Under the Act, the first two don't apply if the insurer would have offered the same cover, at the same premium and on the same terms, even if it had been given the right information. The form's declaration, signed by a managing director, managing partner or principal, confirms the statements are true and commits the business to tell the insurer immediately if anything changes before cover starts.
So if a control is only partly in place, say so. Some forms are built for that: the 2021 form lets you tick "Some systems and applications protected by MFA" and explain where and why it isn't on. For how the duty applies to your business, ask your broker, insurer or a legal adviser.
Who answers which questions: you, your IT provider or your broker
A proposal form mixes three kinds of question, and it helps to split them before anyone starts filling it in.
- IT and security questions go to your IT provider: MFA, backups and restore testing, patching, endpoint protection, email scanning, firewalls and remote access, unsupported systems and encryption. CSPRO answers these questions for its clients.
- Business questions are yours: revenue, the personal information you hold, payment verification procedures, staff training, and incident and claims history. The payment questions matter: the Insurance Council of Australia notes that business email compromise remains a key driver of cyber insurance losses.
- Policy questions go to your broker or insurer: wording, cover, limits, excess and price.
Whoever supplies the answers, they are your business's answers, including the technical ones, and where the form has a declaration, the person who signs it confirms they are true. Read the IT answers before you sign and ask what each "yes" rests on. If an outside provider runs your IT, check what your managed service agreement should spell out about who keeps which records.
Common cyber insurance requirements and the proof behind each one
The table maps questions from the two forms to what a true "yes" needs, the record to keep and who usually holds it. Your insurer's wording will differ, so use the table to prepare, then answer each question exactly as your form asks it. If several rows describe controls you don't have yet, start with the core protections every Australian business should have.
| What the form asks (example) | What a true "yes" needs | Proof to keep | Who usually holds it |
|---|---|---|---|
| Where do you enforce MFA: email, remote access, admin accounts? (2025 form) | MFA enforced for every account in scope | MFA enforcement report and an exceptions list with reasons | IT provider |
| Is access removed promptly when staff leave or change roles, or a vendor contract ends? (2021 form) | Former staff and vendor accounts disabled promptly | Dated leaver records; user list checked against current staff | Both |
| Is critical data backed up at least weekly and stored away from your premises and network? (2021 form) | A recent copy kept apart from your network, out of reach of everyday admin logins | Backup reports showing dates, scope and location | IT provider |
| How often are backups tested for recovery? (2021 form) | Real test restores at the frequency you state | Dated restore-test records with results | IT provider |
| Can you apply critical patches within 30 days? (2021 form) | Critical updates applied within that window on every device and server | Patch compliance report and written patch policy | IT provider |
| Is anti-malware on all desktops, laptops and servers? Do you have advanced endpoint protection? (2021 form) | Protection installed and reporting on every device in your asset list | Console device list matched against the asset list | IT provider |
| Do you scan all incoming email for malicious links and attachments? (2021 form) | Scanning on every mailbox and domain you use | Email filtering settings or report | IT provider |
| Are there firewalls at all internet connections, with non-default configurations? (2021 form) | Every connection covered, with documented settings changed from the defaults | Firewall configuration record | IT provider |
| Do you use end-of-life or unsupported systems? (2021 form) | A complete list, with how each is separated and when it will be replaced | Asset register with end-of-life items and plans noted | Both |
| Do you encrypt laptops, desktops and portable devices? (2025 form) | Encryption on for every device in scope | Device encryption status report | IT provider |
| Do you have an incident response or continuity plan, tested at least annually? (2021 form) | A written plan, tested within that period | The plan with its version date and the last test record | You, with your IT provider |
| How are staff and contractors trained in cyber security? (2021 form) | Training delivered to current staff and contractors | Dated completion or attendance records | You |
| Do you verify bank detail changes and transfers over $2,000 through a second channel? (2025 form) | A separate check, such as a call to the number already on file, every time | Written procedure and a record of checks | You |
Two areas need more than a settings check. If anyone connects to office computers from outside, read about securing remote desktop access before you answer the firewall and remote access questions. For the plan, here's how to put an incident response plan together; make sure yours includes your insurer's contact details and notification requirements.
Many of these questions line up with the Essential Eight, the Australian Signals Directorate's (ASD) eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Neither form mentions the Essential Eight or asks for a maturity level, so use it as a reference point while you prepare. ASD's maturity model FAQ says that, generally, Maturity Level One may be suitable for small to medium enterprises, and that each organisation should plan for a target level suited to its environment. That's security guidance; it doesn't tell you what your insurer will ask. For background, here's what the Essential Eight covers.
ASD's small business cyber security handbook recommends three starting measures: turn on MFA, keep software up to date and back up data regularly. The next three sections cover those areas: MFA, backups, and the devices your updates and protection run on.
Multi-factor authentication: "enforced" means every account
The 2025 form asks whether you enforce MFA for email; for VPN, remote desktop, RD Gateway and other remote access; and for network, cloud admin and other privileged accounts. The 2021 form adds third-party bank applications, plus MFA for online banking log-ins and transfers. A true "yes" means every account in that scope uses MFA. If any account is excluded, such as an emergency access account, record the exception with its reason, and explain it on the form or ask your broker or insurer how to show it.
Older sign-in methods can undo that "yes". Microsoft notes that because legacy authentication doesn't support multifactor authentication, attackers can bypass MFA requirements by using older protocols, such as mail clients that connect with IMAP, SMTP or POP3.
Gaps to check before answering "yes":
- accounts excluded from the MFA policy, and shared accounts people sign in to directly
- older sign-in methods still allowed that skip MFA
- admin and privileged accounts without MFA enforced
- backup consoles and other management portals outside the MFA policy
Backups: separate, recent and actually restored
The 2021 form asks whether critical data is backed up at least weekly and kept away from your premises and network, what is included, and how often restores are tested, with options from quarterly to annually. A true "yes" needs two things. The first is a copy that is separate in practice: if the admin login your team uses every day can reach the backups, so can anyone who steals that login. The second is a dated record of a real test restore at the frequency you state, because a backup job that reports success hasn't proved the data can be restored.
Gaps to check before answering "yes":
- backups reachable with everyday admin credentials, or stored on the same network
- no record of a recent test restore
- systems or data missing from the backup scope
Devices: endpoint protection and patching on every machine
The 2021 form asks whether anti-malware is installed, enabled and automatically updated on all desktops, laptops and servers, whether you have advanced endpoint protection, whether critical patches go on within 30 days, and whether any end-of-life or unsupported systems are in use. "All" is the word to check. A true "yes" needs the device count in your protection console to match your asset list, and a patch report showing critical updates applied within the window you state. If the form asks separately about advanced endpoint protection, it helps to know the difference between antivirus and endpoint detection and response.
Gaps to check before answering "yes":
- devices missing the protection agent
- patching set to "automatic" with no compliance report to show it worked
- unsupported systems still in use
A renewal countdown to run with your IT provider
Start as soon as the renewal date is on the horizon. The order matters more than the exact timing, but leave enough room to fix gaps before the form is due.
- Get this year's form from your broker or insurer early. Ask for it rather than waiting, and compare the questions with last year's.
- Send every IT question to your IT provider. Ask for each answer and what it rests on.
- Check each "yes" against what is actually enforced. Where there's a gap, fix it before you sign. If you can't, don't answer "yes": mark it as partial and explain if the form allows, or ask your broker or insurer how to record it.
- Refresh the proof close to signing. Run a test restore and pull fresh, dated reports for MFA, patching, endpoint coverage and backups. Insurers don't all ask for this, but it means your records show the position on the date you sign.
- Review and sign. Read the IT answers before you sign, and send questions about wording, cover or price to your broker or insurer.
- Report changes and keep your records. If a control changes before cover starts, tell your broker or insurer. Keep the answers and records together for next year's renewal and in case you need to claim.
If you ever need to claim: the IT side
A claim is where your plan and records get used. Make sure your incident response plan holds your insurer's or broker's contact details and your policy's notification requirements. The Insurance Council of Australia notes that many cyber insurers give policyholders access to outside professionals to limit losses, so check your policy wording on whether you must use a nominated responder or get consent before engaging help or paying costs. Preserve logs and other evidence where you can. For the response itself, follow what to do in the first hours after a breach.
How CSPRO Can Help
We're an IT and cybersecurity provider, not an insurer or broker. For its clients, CSPRO answers the IT and security questions on cyber insurance forms and checks for gaps like these before answering "yes". You still review and sign the form, and your broker or insurer handles questions about the policy itself.
If your renewal is coming up, start with CSPRO's free initial cybersecurity risk assessment. CSPRO's cybersecurity services include MFA and identity access controls, managed endpoint protection and antivirus across all devices, email filtering and phishing protection, managed firewall configuration and monitoring, patching schedules and documentation, ongoing alignment with the Essential Eight, and 24/7 threat monitoring. CSPRO's backup and disaster recovery service includes scheduled recovery testing.
For a quick first look, the free online self-assessment takes about three minutes and gives you a score and suggested next steps. It's a general check of your technology, not a review of insurer questions.
Talk to Our Team about a free risk assessment before your renewal.
