By PC Madness ·
The short answer
A cyber insurance application usually comes with a questionnaire about how your business protects its computers, email and data. Answer it with what is true today, not what you plan to do or what your IT provider assumes is in place. If the honest answer is "partly" or "no", say so, explain what is covered, and fix the gap before renewal.
Your answers become part of the contract. As business.gov.au explains, an insurance policy is a legal contract that both sides need to keep their part of, and an insurer may not pay a claim if you haven't met the policy's terms and conditions. A questionnaire filled in optimistically is a claim problem waiting to happen.
What cyber insurance is for
Cyber insurance helps with the cost of an attack, which is often much more than replacing a laptop. According to business.gov.au, cover can include costs to do with:
- cyber extortion or ransomware
- interruptions to your business because of a cyber event
- network security and data breaches, including data recovery costs
- accidental loss or release of customers' personal information
What any one policy actually covers, and excludes, is in its product disclosure statement (PDS). Read it before you buy, including what you need to tell the insurer when you take out the policy and what you need to keep them updated about.
Why insurers ask about your security
An insurer is pricing the chance that your business has a costly incident. The questionnaire is how they judge that chance without visiting your office. Questions vary between insurers and change over time, but they tend to come back to the same controls that stop the most common attacks: stolen passwords, phishing, unpatched software and ransomware.
Insurance is also not a substitute for those controls. The ASD's Essential Eight maturity model FAQ is blunt about it: a business that relies on cyber insurance instead of implementing a whole strategy, such as multi-factor authentication, is treated as having not protected itself against that threat. Insurance pays for some of the damage; it doesn't prevent it.
The areas questionnaires usually cover
Wording differs, but most questionnaires ask about some or all of these. Knowing the honest answer to each before you sit down with the form makes it much quicker.
- Multi-factor authentication. Whether it's on for email, remote access and admin accounts, and whether that's every account or only some.
- Backups. How often you back up, whether a copy is kept separate from your network, and when you last tested a restore.
- Endpoint protection. What protects your computers and servers, and whether anyone watches and responds to its alerts.
- Patching. How quickly updates for operating systems and software get installed, and whether anything is past its end of support.
- Email security. Filtering for phishing and malicious attachments, and whether your domain's email authentication is set up.
- Admin access. Who has administrator rights, and whether staff use standard accounts day to day.
- Remote access. How staff connect from outside the office, and whether anything like remote desktop is open to the internet.
- Staff training. Whether staff are trained to spot phishing, and how often.
- Payments. How you verify a change to a supplier's bank details before paying.
- Incident response. Whether you have a written plan and know who to call.
- Past incidents. Any breaches, attacks or claims in recent years.
How to answer honestly
Most problems come from answering a question nobody checked. A few habits avoid that:
- Check, don't assume. "Multi-factor authentication is on" is often true for most staff but not the old shared mailbox or the owner's admin account. Ask for the actual list.
- Read "all" and "every" carefully. If the question says all users or every device and you have exceptions, the answer is no, or yes with the exceptions explained.
- Answer for today. "We're rolling it out next month" is a no for now. Say what's planned and when, if the form allows it.
- Don't guess at technical terms. If you don't know whether you have "EDR" or an "immutable backup", ask your IT provider in writing and keep their reply.
- Keep evidence. Save screenshots, reports or a short written summary of each control with your copy of the application. It helps at renewal and if you ever need to claim.
- Tell the insurer when things change. If a control is removed or your business changes, check your PDS for what you need to keep the insurer updated about.
A broker can help you read the questions and the PDS. Business.gov.au notes that insurance brokers must hold an Australian Financial Services licence, which you can check on ASIC's professional register.
When "no" is the right answer
To be fair to smaller businesses: you don't need every control on the list to get cover, and an honest "no" is far better than a wrong "yes". A sole trader with a laptop, cloud email and a good backup may only face a short questionnaire, and some answers simply won't apply. If a question doesn't fit how you work, explain rather than tick the nearest box.
If a "no" is pushing your premium up or putting cover at risk, the cheapest fixes are usually the ones the ACSC recommends in its ransomware guidance: turn on multi-factor authentication, keep software and devices updated, and keep a backup the attack can't reach and that you can actually restore.
Getting ready before renewal
The best time to prepare is a month or two before the questionnaire arrives:
- Ask your IT provider for a written summary of the controls listed above, with any gaps.
- Close the quick gaps first: multi-factor authentication on every email and admin account, and a tested restore.
- Write a one-page incident plan: who to call, where the backups are, who can make decisions. Our ransomware first-hour checklist is a good start.
- Keep last year's answers and compare. Anything that has changed should be reflected in this year's.
For a wider benchmark, the ASD's Essential Eight is the Australian baseline many questionnaires overlap with. Our plain-English guide to the Essential Eight and its maturity levels explains what each strategy means.
How we help
Our Essential Eight assessment checks your devices, accounts and backups against the ASD's baseline and gives you a written list of what's in place and what isn't, which makes questionnaire answers straightforward. With managed IT services, our weekly and monthly security reports show patch status, blocked threats and endpoint protection, so you have a record to answer from.
Got a questionnaire on your desk? Send us a message or call 08 9250 4554 to book a free, obligation-free IT security audit, and we'll help you work out the honest answers. We can't give insurance advice, so talk to your broker or insurer about the policy itself.
