Cyber insurance readiness in Australia

APRA cyber resilience supervision

APRA's prudential standard CPS 234 has shaped market expectations across the financial sector and flowed through to broader Australian underwriting practice.

Insurance Council of Australia position

The ICA describes cyber insurance as a part of a broader risk management framework rather than a substitute for security controls. Underwriters increasingly underwrite the controls, not the business.

Broker market commentary

Major Australian brokers report that proposal forms now run to 20+ pages with detailed control attestations and that misrepresentations on those forms are a leading reason for claim disputes.

Multi-factor authentication, universal

MFA enforced for all users, all admins, all remote access, all email, and all cloud administration. Single exclusion is enough to materially affect cover.

Endpoint Detection and Response

EDR or XDR on all endpoints. Traditional signature-based antivirus is no longer treated as a sufficient control by mainstream Australian underwriters.

Tested backups, offline or immutable

Backups protected from the production environment, with documented and recent successful restore tests. Most insurers ask the specific date of the last test restore.

Patching cadence

Critical vulnerabilities patched within 14 days, often 48 hours for internet-facing systems. Aligned with Essential Eight Maturity Level One.

Documented security awareness training

Annual baseline training plus quarterly phishing simulation. Completion rates evidenced by report extract.

Documented incident response plan

A written plan covering detection, containment, communications and OAIC notification. Tested at least annually in a tabletop exercise.

MFA coverage report

Microsoft 365 or identity provider report showing MFA registered users vs total active users, dated within 30 days of submission.

EDR coverage report

Endpoint protection console export showing managed devices vs known assets, dated within 30 days.

Backup attestation

One-page document signed by the backup provider or internal IT manager, naming the backup product, retention period, last successful restore date and the protection model (offline, immutable or air-gapped).

Patch compliance report

Either a vulnerability scanner export or an RMM patch compliance report showing percentage of devices compliant, dated within 30 days.

Training completion report

Learning management system export showing completion rate, plus a sample phishing simulation report.

Incident response plan extract

Cover page and table of contents of the IR plan, plus the date of the last tabletop exercise. Full plan only on underwriter request.

Is MFA enforced for ALL users accessing email and remote access?

Single 'no' answer is the most common reason for declined cover or significant retention loading.

Do you have EDR on 100% of endpoints?

Insurers distinguish EDR from antivirus by feature set. Microsoft Defender for Business and Defender for Endpoint P1/P2 are generally accepted.

Are privileged accounts protected by phishing-resistant MFA?

Hardware keys or platform authenticators. SMS-based MFA on privileged accounts now flagged on most forms.

What is the frequency of your backup restore tests?

Quarterly is the practical floor. Annual is often acceptable for smaller businesses but trending toward unacceptable.

Do you have a written incident response plan, last tested within 12 months?

Tabletop attestation date is now a standard question, not just plan existence.

Have you experienced a cyber incident in the last 5 years?

Disclosure obligation is broad. Underdisclosure on this question is one of the leading reasons for claim disputes.

Notify the insurer first

Policy notification clauses typically require notification within 24 to 72 hours of awareness. Late notification is grounds for declinature.

Engage the panel firms

Insurer-approved IR, legal and forensic firms are mobilised. Their fees are paid under the policy. Your own preferred advisors may be excluded.

Cooperate with the investigation

Insurers and panel firms investigate root cause and verify the controls declared on the proposal form. Misalignment can result in coverage disputes.

Parallel OAIC and ASD obligations

Claim cooperation does not pause the OAIC Notifiable Data Breach clock or, if applicable, the 72-hour ASD ransomware payment reporting obligation.

Business interruption proof

BI claims require detailed evidence of lost revenue, increased cost of working, and the causal link to the incident. Pre-existing financial records and continuity plans materially affect outcomes.

T-minus 90 days

Refresh the evidence pack. Re-run MFA, EDR, patching and backup reports. Confirm the IR plan tabletop date is within 12 months.

T-minus 75 days

Initial broker meeting. Identify any changes in business operations, headcount, revenue, or sensitive data holdings that affect the proposal.

T-minus 60 days

Submission lodged with three or four insurers via the broker. Underwriter questions returned within 5 to 10 business days.

T-minus 30 days

Quotes returned. Comparison of limits, retentions, sub-limits and panel arrangements. Negotiation of any material wording points.

T-minus 14 days

Final terms accepted. Endorsements documented. Internal communication of any changed reporting obligations under the new policy.

Day zero

Policy incepts. Renewal evidence pack and policy documents archived for the next renewal cycle.