The short answer: cyber insurers now decide whether to cover you, and at what price, based on the security controls you have in place. Their cyber insurance questionnaires focus on a handful of controls: multi-factor authentication, backups, endpoint protection, patching, staff training and payment fraud procedures. Answer every question accurately, because an incorrect answer can put a future claim at risk.
A few years ago, a cyber insurance application was a page of general questions. Today it can run to dozens of detailed, technical questions, often filled in by someone who is not sure what half of them mean. This guide explains what insurers typically ask Australian businesses, why, and how to answer your cyber insurance questionnaire with confidence.
Why the questions got harder
Ransomware and business email compromise claims grew rapidly, and insurers paid out heavily. They responded by tying cover to specific controls they believe reduce claims. If a control is missing, you may face a higher premium, an exclusion, a lower limit or a declined application.
Common cyber insurance questionnaire questions
Every insurer's form is different, but most focus on the same core areas.
1. Multi-factor authentication (MFA)
Expect questions about MFA on email, remote access (such as VPN or remote desktop), cloud services and administrator accounts. Insurers often ask about each separately. "We have MFA" is not enough if it only covers email and not remote access. For most businesses this starts with Microsoft 365.
2. Backups
Insurers want to know how often you back up, whether backups are kept separate from your main network (offline, immutable or in a separate cloud account), whether they are encrypted, and when you last tested a restore. A backup you have never tested is a hope, not a plan.
3. Endpoint detection and response (EDR)
Traditional antivirus is no longer enough for many insurers. They increasingly ask whether every device runs EDR and whether alerts are monitored, ideally around the clock, which is part of good managed IT services.
4. Patching and unsupported systems
How quickly do you apply critical security updates? Do you run any software or operating systems that no longer receive updates? Unsupported systems are a common reason for exclusions.
5. Privileged access
Do staff use separate accounts for administrative work? Who has admin rights, and are they reviewed? Limiting admin access is one of the most effective ways to stop an attacker spreading through your network.
6. Email security
Insurers ask about email filtering, protection against phishing and impersonation, and email authentication (SPF, DKIM and DMARC) that stops attackers spoofing your domain.
7. Staff training and phishing simulations
Most attacks start with a person. Insurers ask whether staff receive regular security awareness training and whether you run simulated phishing tests.
8. Payment and funds transfer procedures
Fake invoices and payment redirection scams are among the most common claims. Expect questions about how you verify changes to bank details and whether payments above a threshold need a second approval or a call-back on a known number.
9. Incident response
Do you have a written incident response plan? Do people know who to call? Insurers want to see that you can respond quickly and limit the damage. Some also ask whether you have had a recent penetration test.
10. Operational technology and third parties
If you run operational technology, such as SCADA or industrial control systems, or rely on suppliers with access to your systems, expect questions about how those connections are separated and secured.
How to answer a cyber insurance questionnaire accurately
- Check, do not assume. Confirm each answer against how your systems are actually configured. Your IT provider should be able to show you.
- Read the question carefully. "MFA on all remote access" means all of it, including that one old remote desktop connection.
- Do not round up. If a control is partly in place, say so and explain your plan. An honest "in progress" is far better than an inaccurate "yes".
- Keep evidence. Screenshots, reports and policies support your answers if an insurer asks, or if you ever need to make a claim.
- Talk to your broker. They can explain how each insurer interprets its questions and what your policy requires.
Remember that the answers are your declaration. Your IT provider can supply the technical detail, but you are responsible for what you submit.
Turn the questionnaire into a security plan
The questionnaire is effectively a list of the controls insurers believe stop the most expensive incidents. That makes it a useful roadmap. Most of the controls also align with the Essential Eight and SMB1001, so work you do for your renewal strengthens your security and counts towards certification.
Start early. Implementing MFA, EDR or separated backups can take weeks, and a renewal deadline is a stressful time to discover a gap.
How we help
We work through cyber insurance questionnaires with businesses in Perth and Melbourne, check each answer against their environment, and implement the missing controls. We are not insurance brokers and do not advise on policies, but we make sure the security side is right. Learn more about our cyber insurance support.
Frequently asked questions
What happens if I answer a cyber insurance question incorrectly?
An inaccurate answer could affect your cover or a future claim. Check each answer against your actual systems and talk to your broker if you are unsure.
What controls do cyber insurers require?
Requirements vary, but most insurers focus on MFA, secure and tested backups, endpoint detection and response, patching, staff training, email security and payment verification procedures.
How long before renewal should I start?
Ideally a few months. Some controls take weeks to implement properly, so starting early avoids rushed answers and last-minute gaps.