RemoteCyber insurance readiness
The proposal form is a security audit. Answer it accurately.
Cyber insurers now ask detailed questions about MFA, backups, endpoint protection, patching and payment processes, and your answers form part of the policy. Here is what they check, how to get ready before renewal, what to do at claim time, and an 11-point check to run now.
Cost data from ASD; claims data from Coalition. General information, not insurance advice. Checked 31 October 2026.
- What insurers check
- Claim-time steps
- 11-point check
Reviewed by Blake Bath, General Manager, on 31 October 2026.
Why it matters
What incidents cost, and what drives claims.
Two numbers worth knowing before your renewal.
A$56,600 average
Self-reported cost per cybercrime report for Australian small businesses in 2024-25 (ASD). A$97,200 for medium businesses.
- Know your exposure
- Right cover limit
- Controls first
60% of claims
Email compromise and funds transfer fraud, in Coalition's 2024 claims data.
- Payment checks
- DMARC
- Mailbox monitoring
Ransomware
Less frequent than fraud, but still the most costly and disruptive claims.
- Separate backups
- EDR
- Tested restore
Your answers
The proposal form becomes part of the policy. Accuracy matters as much as the controls.
- Evidence ready
- Exceptions stated
- Broker involved
Cyber insurance readiness check
Could you answer the proposal form honestly today?
Tick what you could prove to an insurer right now. You get the gaps in the order we would close them.
Tick what you could prove to an insurer today.
Where you stand
0of 11 controls in place
11 gaps to close.
- MFA on email, remote access and every admin accountThe first question on almost every proposal form.
- Endpoint detection and response on every device and serverInsurers ask about EDR coverage, not just whether it is installed.
- Backups kept apart from the network, with a restore testedRecovery without paying a ransom depends on it.
- Separate admin accounts, no shared loginsShared and everyday admin accounts are a common gap insurers ask about.
- Critical patches applied in days, with evidenceExploited vulnerabilities are a leading way in.
- No unsupported operating systemsUnsupported systems are a standard proposal question.
- Email authentication and filteringEmail fraud drives most claims.
- Payment and bank detail changes verified by phoneEmail fraud and funds transfer fraud were 60% of Coalition's 2024 claims.
- Staff training and phishing practiceProposal forms ask for frequency and evidence.
- Logs kept long enough to investigateWithout logs, investigators cannot show what happened.
- An incident plan with the insurer's hotline in itPolicies often require early notification and use of the insurer's panel.
The questions
What insurers commonly ask about, and the evidence to have ready.
| Area | What they ask | Evidence to keep |
|---|---|---|
| MFA | Email, remote access, admins, cloud apps | Conditional Access policies and an MFA coverage report |
| Endpoint protection | EDR on all devices and servers, monitored | Device coverage report and monitoring arrangement |
| Backups | Separate, protected from deletion, tested | Backup design and dated restore test |
| Admin access | Separate admin accounts, no shared logins | Admin list and review record |
| Patching | How fast critical patches are applied | Patch reports, especially for internet-facing devices |
| Email and payments | Filtering, DMARC, payment verification | DMARC record, payment procedure |
| Incident response | A plan, tested, with contacts | Plan document and exercise record |
Every insurer's form is different. Read each question literally and answer what is true today.
If it happens
What to do at claim time.
- Notify earlyCall the insurer's incident line as your policy requires. Late notice can complicate a claim.
- Use the panelForensics, legal and communications through the insurer's panel if the policy requires it.
- Preserve evidenceDon't wipe or restore until affected systems are captured.
- Document everythingTimeline, decisions, communications and costs.
- Check statementsLegal review before anything goes to customers or the public.
What goes wrong
Common mistakes at renewal.
- Best-case answersTicking yes to a control that is only partly in place.
- Policy instead of controlsTreating cover as a substitute for MFA, backups and EDR.
- Untested plansA plan on paper nobody has walked through.
- Backups on the same domainOne compromised admin account reaches both.
- Starting lateControls take weeks to put in place. Start 60 days before renewal.
Our view
Get the evidence ready, not just the controls.
Most businesses we help already have half the controls insurers ask about. What they lack is evidence: a coverage report, a dated restore test, an admin list. We put those together before the form is due, so every answer is backed by something you can show.
And we fix the payment process first. Email fraud drives most claims, and phone verification of bank detail changes costs nothing.
The order
Getting renewal-ready in five steps.
- Step 1Read the form early
Sixty days out, with your broker.
- Step 2Check each answer
Against what is actually in place.
- Step 3Close the quick gaps
MFA, payment checks, admin accounts.
- Step 4Gather evidence
Reports, restore test, plan, training records.
- Step 5Rehearse the incident
With the insurer's hotline in the plan.
Related guides
Insurance readiness in depth. Controls and response.
The controls insurers ask about, explained.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about cyber insurance readiness.
What do cyber insurers check before they quote?
Usually MFA on email, remote access and admin accounts, endpoint detection and response, backups kept apart from the network and tested, patching, unsupported systems, email security, payment verification, staff training and an incident response plan. Each insurer's proposal form differs, so read yours closely.
Can a wrong answer on the proposal form affect a claim?
It can. Answer accurately, describe exceptions honestly, and fix gaps rather than rounding up. If you are unsure what a question means, ask your broker before you sign. This is general information, not insurance advice.
What does a cyber incident cost an Australian small business?
In ASD's Annual Cyber Threat Report 2024-25, the average self-reported cost per cybercrime report was A$56,600 for small businesses and A$97,200 for medium businesses.
What causes most cyber insurance claims?
In Coalition's 2025 Cyber Claims Report, business email compromise and funds transfer fraud made up 60% of 2024 claims. Ransomware claims were less frequent but remained the most costly and disruptive.
Does the Essential Eight help with insurance?
It gives you a recognised way to describe your controls and evidence them. Many proposal questions map to Essential Eight strategies such as MFA, patching, admin privileges and backups. Whether it changes your premium is up to the insurer.
What should we do first if something happens?
Follow your policy: notify the insurer's incident line early, use their panel for forensics and legal help if required, preserve evidence before wiping or restoring, and keep a timeline of every decision and cost.
Next step
Renewal coming up?
We check your controls against the proposal form, close the quick gaps, and pull together the evidence so every answer is backed by something you can show.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. General information only, not insurance advice. Talk to your broker about your policy. Checked 31 October 2026. ASD, Annual Cyber Threat Report 2024-25 factsheet for businesses; Cyber Daily, Annual Cyber Threat Report 2024-25 by the numbers; Coalition, 2025 Cyber Claims Report; ASD, Essential Eight maturity model