Cyber insurance has become a common safety net for Australian small businesses. It can help cover costs after a cyber incident, such as business interruption, legal support, recovery work, and customer notifications.
But getting a policy is no longer as simple as filling in a form and paying the premium. Insurers are asking more questions about how your business protects itself. If your answers are vague, outdated, or incorrect, you may struggle to get cover, pay more for it, or face problems when making a claim.
Why cyber insurers are asking tougher questions
Cyber attacks are no longer only aimed at large companies. Small businesses are regularly targeted because they often have weaker security and fewer internal IT resources.
For insurers, this means more claims and higher risk. In response, many cyber insurance providers now expect businesses to show they have basic protections in place before they offer cover.
This does not mean you need a large IT department. It does mean you need to take reasonable steps to reduce the chance and impact of an attack.
Common cyber insurance requirements in Australia
Every insurer is different, and requirements can change depending on your industry, turnover, number of staff, and the type of data you hold. However, most cyber insurance applications now ask about similar areas.
1. Multi-factor authentication
Multi-factor authentication, often called MFA, is one of the most common requirements. In plain English, it means staff need more than just a password to log in.
For example, after entering a password, they may need to approve a sign-in on their phone or enter a one-time code. This is especially important for email, Microsoft 365, remote access, cloud apps, and admin accounts.
If your business does not use MFA, some insurers may refuse cover or exclude certain claims linked to stolen passwords.
2. Regular and tested backups
Backups are critical if your files are deleted, damaged, or locked by ransomware. Insurers often want to know whether you back up important systems and how often those backups happen.
Just as importantly, they may ask whether backups are tested. A backup that has never been checked may not work when you need it most.
Good backup practices usually include:
- Backups that run automatically
- Copies stored away from the main system
- Regular checks to confirm files can be restored
- Clear responsibility for who monitors backup success or failure
3. Security software on computers and servers
Insurers commonly ask whether your business uses current security protection on devices. This may include antivirus or more advanced monitoring tools that look for suspicious activity.
The key point is that every business computer should be protected, updated, and monitored. A single forgotten laptop can create a gap attackers may use.
4. Software updates and patching
Old software is a common way for criminals to break into systems. Cyber insurance applications may ask how quickly your business applies updates to computers, servers, firewalls, and cloud systems.
For small businesses, this is usually about having a clear routine. Updates should not be left to chance or ignored because they are inconvenient.
5. Staff cyber awareness training
Many cyber incidents start with a person clicking a fake email, opening a dangerous attachment, or entering a password into a fake login page. Insurers know this, so they often ask whether staff receive cyber security training.
Training does not need to be complicated. It should help staff recognise common risks, including fake invoices, payment redirection scams, suspicious links, and urgent requests that pressure them to act quickly.
6. Email security and payment checks
Email is one of the biggest risk areas for small businesses. If an attacker gets into a mailbox, they can read private messages, send fake invoices, or trick customers and suppliers.
Some insurers may ask about protections for email, such as spam filtering, MFA, and controls that reduce fake sender addresses. They may also ask whether your business confirms bank account changes by phone before paying invoices.
That phone call should be made using a trusted number you already have, not a number listed in the suspicious email.
7. Access control
Cyber insurers may want to know who has access to your systems and whether staff have more access than they need.
A practical approach is simple: staff should only access the files, apps, and accounts required for their role. When someone leaves the business, their access should be removed promptly.
Admin access should be limited to people who genuinely need it. Shared logins should be avoided because they make it hard to know who did what.
8. Incident response plan
An incident response plan explains what your business will do if something goes wrong. It does not need to be a 50-page document. It does need to be clear and usable under pressure.
A basic plan should include:
- Who to contact first
- How to isolate affected computers
- Where backups are stored
- How to contact your insurer
- Who handles customer, supplier, and staff communication
- When legal, privacy, or regulatory advice may be needed
Having a plan can save valuable time during an incident, when confusion can make the damage worse.
What happens if you answer insurance questions incorrectly?
Cyber insurance forms can be detailed, and it may be tempting to tick yes when you are not completely sure. This can create serious problems later.
If a claim is made and the insurer finds that your answers were inaccurate, the claim may be delayed, reduced, or denied depending on the policy and circumstances. That is why it is worth checking your security position before applying or renewing.
If you are unsure, ask your IT provider to help you review the questions. You want answers that are accurate, not optimistic.
Cyber insurance is not a replacement for good security
Insurance can help with recovery costs, but it will not prevent an attack. It also may not cover every loss, such as reputational damage, lost customers, or the time spent getting the business back to normal.
The best approach is to treat cyber insurance as one part of your protection, not the whole plan. Strong day-to-day security reduces the chance of a claim and can make insurance easier to obtain.
How small businesses can prepare for cyber insurance
If your business is applying for cyber insurance or approaching renewal, start with the basics. You do not need to fix everything in one day, but you should know where your gaps are.
A practical preparation checklist includes:
- Turn on MFA for email, cloud apps, and remote access
- Confirm backups are running and can be restored
- Update computers, servers, and network equipment
- Check every device has active security protection
- Remove old staff accounts and unused access
- Train staff on common email and payment scams
- Create a simple incident response plan
- Keep records of your security settings and processes
Keeping basic records is important. If an insurer asks for evidence, you will be in a better position to respond clearly.
Need help meeting cyber insurance requirements?
Cyber insurance requirements can feel confusing, especially if you are not technical. The good news is that most small businesses can make real progress by getting the fundamentals right.
JCPIT Support helps Australian small businesses understand their cyber risks, improve their security, and prepare for insurance questions in plain English.
If you are applying for cyber insurance, renewing a policy, or unsure whether your current setup meets expectations, book a free security check with JCPIT. We will review the key areas insurers commonly ask about and help you understand your next steps.
