Cyber insurance requirements in Australia: there is no single list
If you are searching for the official cyber insurance requirements in Australia, you won't find them. No regulator publishes a standard list. Each insurer writes its own proposal form, and the questions change from year to year and with the size and type of your organisation.
The themes, though, are consistent. Insurers commonly ask whether you use multi factor authentication (MFA), how you back up and whether you test restores, how quickly you patch, whether you limit administrator accounts, what protects your computers and email, and whether you have an incident response plan. Almost all of those map to controls in ASD's Essential Eight, the eight mitigation strategies the Australian Signals Directorate rates as the most effective of its broader list.
That makes the Essential Eight a sensible yardstick for your answers, even though it isn't an insurance standard. One recent change: on 15 October 2026 ASD published its new ASD Essentials series. Its FAQ explains "Why is ASD replacing the Essential Eight?", says the series is "written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations", and says ASD "will advise on expectations for transitioning to the new framework in due course". It also says organisations "should continue their current uplift programs". For a 10 to 200 person business, the Essential Eight is still the practical reference, and it is the language most questionnaires use.
General information, not legal or insurance advice
This article explains how questionnaire themes relate to ASD's public guidance. It is not legal or insurance advice. What your policy covers, and what your insurer expects, depends on the policy wording. Talk to your broker or insurer about your own situation.
Why accurate answers matter at claim time
A proposal form is not a formality. The insurer relies on your answers to decide whether to cover you and on what terms. A wrong answer can create problems when you claim, the moment you most need the policy to work.
The Insurance Contracts Act 1984 sets out the duties. A consumer insurance contract is one obtained "wholly or predominantly for the personal, domestic or household purposes of the insured", and for those the insured has "a duty to take reasonable care not to make a misrepresentation" (section 20B). A business cyber policy usually isn't a consumer contract, so the duty of disclosure in section 21 is the one to know. It requires the insured to disclose, before the contract is entered into, "every matter that is known to the insured" that is relevant to the insurer's decision "whether to accept the risk and, if so, on what terms".
Two more points matter for renewals and claims:
- Renewal counts. Section 11(9) says entering into a contract includes an agreement to "renew, extend or vary the contract". Each renewal questionnaire deserves the same care as the first one.
- Remedies affect claims. For general insurance, section 28 says that if a failure "was fraudulent, the insurer may avoid the contract". Otherwise the insurer's liability for a claim can be reduced "to the amount that would place the insurer in a position in which the insurer would have been if the relevant failure had not occurred".
How those rules apply to a particular claim is a question for your broker or a lawyer. The practical lesson: answer what is true today, and be able to show it.
A tick on a proposal form is a statement about your business. Make sure you could prove it the day after an incident.
Good evidence, not good intentions
ASD's Essential Eight assessment process guide grades evidence in four levels. At the top is "Excellent evidence: Testing a control with a simulated activity designed to confirm it is in place and effective". At the bottom is "Poor evidence: A policy or verbal statement of intent". A questionnaire answer backed only by a policy document, or by "our IT provider looks after that", sits at the poor end. Aim for reports, screenshots and test results instead.
What insurers commonly ask, and how to answer honestly
Wording varies, but these themes come up again and again. For each: what ASD says, what an honest answer depends on, and what we do about it.
Multi factor authentication
ASD's Essential Eight maturity model says, at Maturity Level One, that "Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or communicate their organisation's sensitive data". Questionnaires often ask separately about email, remote access and administrator accounts. Answer for every account, including shared mailboxes, service accounts and the practice owner who was excused because the app was inconvenient. One exception means "partly", not "yes".
How CSG fixes this: we roll out and enforce MFA across Microsoft 365, remote access and administrator accounts using conditional access policies, then export a coverage report so you can see exactly who is covered and who isn't.
Backups and restore testing
At Maturity Level One, ASD expects backups to be "retained in a secure and resilient manner", that "Unprivileged user accounts are prevented from modifying and deleting backups", and that restoration "is tested as part of disaster recovery exercises". The assessment guide adds that testing should happen at least annually and not be "left until after the first major security incident is experienced". If you have never restored a full system from backup, don't say your backups are tested.
How CSG fixes this: our backup and disaster recovery service keeps immutable backups in Australian data centres that ransomware can't encrypt or delete. We test restores and keep the dated results, so you have a restore log to point to. Tested recovery, not assumed recovery.
Patching
The maturity model sets timeframes. At Maturity Level One, patches for internet facing servers and network devices are applied "within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist", and workstation operating systems "within one month of release". It also says "Operating systems that are no longer supported by vendors are replaced". That catches the forgotten Windows 10 PC: our Windows 10 ESU guide covers what to do with those.
How CSG fixes this: as part of managed IT we run automated patch management across servers, laptops and desktops, scan for missing updates, and report on patch status so you can show which devices are current and which are exceptions.
Administrator privileges
ASD expects that "Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access". If staff use an administrator account to read email, the honest answer to "do you restrict admin rights?" is no.
How CSG fixes this: we separate everyday and administrator accounts, use role based and just in time administrative access, and review privileged accounts regularly, so there is a short, current list of who has admin rights.
Endpoint protection and monitoring
Many forms ask whether you run endpoint detection and response (EDR), software on each computer that watches for suspicious behaviour and can isolate a device, and whether anyone monitors its alerts out of hours. EDR isn't one of the Essential Eight. ASD's transition guidance notes that the Essential Eight spread logging, monitoring and incident response across individual strategies, and the new Essentials series brings them together in a "Visibility and response" domain. The Essential Eight's application control, Office macro and user application hardening controls are related questions: at Maturity Level One "Application control is implemented on workstations" and "Microsoft Office macros in files originating from the internet are blocked". Count every device, including the laptop that hasn't checked in for three months.
How CSG fixes this: we protect computers, laptops and mobile devices with managed endpoint protection, monitor alerts 24/7, block internet macros and apply application control. We can export a device list showing what is protected.
Email security and phishing
ASD's guidance on how to combat fake emails says to "Implement DMARC (with SPF and DKIM) to stop criminals faking an email domain (domain spoofing) and improve email authentication". These are settings in your domain's DNS records. Insurers also commonly ask about staff training to spot phishing.
How CSG fixes this: we configure email filtering and phishing protection in Microsoft 365, set up SPF, DKIM and DMARC for your domain, and run phishing awareness training for staff, with records of who has completed it.
Incident response plan
ASD's incident response planning guidance says "all organisations should have a cyber security incident response plan" and that "This plan should be regularly tested and reviewed". Its template has a section on insurance: "Include relevant details about any insurance policies for cyber security incidents."
How CSG fixes this: we write the incident response plan with you, including your insurer's contact steps and the reporting rules below, and help you run a tabletop exercise so the people named in it know their roles.
Questionnaire themes mapped to the Essential Eight and the evidence to keep
Use this table to prepare before you open the form. The evidence column is what you would want on file if an insurer, or an assessor, asked you to show your answer.
| Common questionnaire theme | ASD control or guidance | Evidence to keep |
|---|---|---|
| MFA on email, remote access and admin accounts | Essential Eight: multi factor authentication | MFA coverage report listing every account, with any exceptions and why |
| Backups, offline or immutable copies, restore testing | Essential Eight: regular backups | Backup job reports, a dated full restore test log, list of who can delete backups |
| Patching speed and unsupported systems | Essential Eight: patch applications, patch operating systems | Patch compliance report, vulnerability scan results, list of unsupported devices with retirement dates |
| Limiting admin rights | Essential Eight: restrict administrative privileges | Current list of privileged accounts, last access review date |
| Blocking malicious software | Essential Eight: application control, restrict Microsoft Office macros, user application hardening | Policy settings export or screenshots, approved application list |
| EDR and out of hours monitoring | Not one of the Essential Eight; "Visibility and response" in ASD's new Essentials | EDR device coverage report, monitoring arrangement and escalation contacts |
| Email security and phishing training | ASD guidance on combating fake emails | SPF, DKIM and DMARC records, training completion records |
| Incident response plan | ASD incident response planning guidance | Current plan with review date, insurer contacts, last exercise notes |
Date everything
A restore test from two years ago or an MFA report from before your last staff intake proves less than you think. Refresh the evidence in the month before renewal, and keep a copy with the questionnaire you submitted.
When something goes wrong: your insurer, ASD and the 72 hour rule
Your policy has its own notification steps: read them now and copy them into your incident response plan. ASD's steps to take following a ransomware attack recommend recording what happened, including the ransom message and the devices affected, so you can "make an insurance, bank or legal claim after the attack". The same page is clear: "Never pay a ransom."
There is also a legal reporting duty if a payment is made. Under section 27 of the Cyber Security Act 2024, a business with an annual turnover for the previous financial year that "is equal to or exceeds $3 million" must report a ransomware or cyber extortion payment within 72 hours, using ASD's ransomware payment reporting form. The form says this covers a payment you made, or one you are aware "another entity has made on your behalf". Write that into your plan so nobody has to work it out under pressure.
If personal information is involved, the Notifiable Data Breaches scheme may apply too. Our guide to data breaches in general practice explains the 30 day assessment rule and what a response plan should cover.
Before your next renewal: a checklist
Work through this with whoever completes the questionnaire and your IT provider, at least a month before renewal.
- Get last year's questionnaire and compare it with what is in place today
- Run an MFA coverage report for email, remote access, cloud apps and admin accounts, and fix or record every exception
- Run a full restore test from backup, and save the dated result
- Confirm who can delete or change backups, and that ordinary user accounts can't
- Pull a patch compliance report and list any unsupported operating systems with their retirement dates
- List every privileged account and remove any that aren't needed
- Export an EDR coverage report and check that every device has checked in recently
- Check your SPF, DKIM and DMARC records, and your staff phishing training records
- Review the incident response plan, add your insurer's notification steps and the 72 hour ransomware payment rule, and run a short exercise
- Answer each question for what is true today, mark anything partial as partial, and ask your broker if a question is unclear
- Keep a copy of the submitted questionnaire with the evidence behind it
How CSG helps you answer with confidence
We are a Gold Coast based team, supporting organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. We are ISO/IEC 27001:2022 certified and audited annually, and we work to the ACSC Essential Eight.
Before a renewal, we review your environment against the questionnaire themes above, fix the gaps through our cyber security, backup and Microsoft 365 services, and pull together the reports that show what is in place: MFA coverage, restore test results, patch status, endpoint coverage and your incident response plan. Your answers stay yours. We make sure you have the facts and the evidence to give them accurately. Talk to our team or call us on (07) 5551 2333.