What Australian cyber insurers actually ask at renewal

Why this matters more than it used to

In 2020 the question on an Australian cyber-insurance renewal was whether you had a firewall and antivirus. In 2026 the question is whether you can evidence, in writing, around two dozen specific controls at the level the underwriter considers substantiated.

That change reflects the cyber-insurance category maturing from self-certified policies with light questioning into controls-based underwriting — the same direction professional indemnity went in the 1990s. Premiums rose, loadings appeared, and organisations that assumed their renewal would be a formality found it was not.

Three things have changed in the last eighteen months that every managing partner, CFO, practice manager, and board director should know:

The questionnaire is now specific. “Do you have MFA?” has become “produce an export showing MFA coverage by user type, dated within the last ninety days, covering privileged and non-privileged accounts, annotated for exceptions.”
“We have it” is no longer an acceptable answer to many questions. The insurer wants evidence on file — often a log, an export, or a dated screenshot. A verbal assurance from the MSP does not transfer risk.
Even in a softening market, underwriters hold the line on controls evidence — the sharper pricing goes to organisations that can prove their controls; the friction and conditions land on those that cannot.

The control set — five families

Every major Australian insurer in the SME market works from a roughly similar control set, framed around the ACSC Essential Eight, NIST CSF 2.0, and their own incident-claims data. The specific wording differs; the substance overlaps. The controls fall into five families.

Identity and access (six controls)

This is the family insurers tighten on hardest, because compromised identity is the most common first step in claims data.

Multi-factor authentication on all user accounts
Multi-factor authentication on all privileged accounts, with a phishing-resistant factor
Separate privileged accounts from daily-use accounts
Conditional access policies limiting risk-based access
Regular review of privileged role membership
Offboarding evidence — departed staff removed within a documented window

Evidence: an account-coverage export; a screenshot of current conditional-access policy; a role-membership log; an offboarding checklist.

Endpoint protection (five controls)

Endpoint detection and response (EDR) deployed to every endpoint
EDR console monitored, with alerting reaching a human within a documented response time
Patch compliance for operating systems — target window
Patch compliance for applications — target window
Application allowlisting — maturity-dependent; asked of larger or higher-risk insureds rather than gated universally

Evidence: EDR console coverage export; patch-compliance report; allowlist policy.

Email and collaboration (three controls)

Anti-phishing controls on email
Safe Links / Safe Attachments or equivalent
External-sharing governance on collaboration platforms (Microsoft 365, Google Workspace)

Evidence: tenant security policy export; external-sharing report.

Backups and recovery (four controls)

The family most likely to break a renewal that otherwise looks solid.

Backups covering all in-scope systems
Immutability — at least one copy protected from modification by an admin-credentialed threat actor
Retention aligned to the insurer’s expectation
Documented successful restore-test within a specified window (often ninety days)

Evidence: backup job coverage report; immutability attestation from the backup vendor; a dated successful restore log.

Governance, incident response, and awareness (seven controls)

Documented incident-response plan, owner-assigned
Annual incident-response exercise (who attended, what was rehearsed)
Third-party risk assessment for critical vendors (MSP, cloud providers)
Staff security awareness training, documented cadence
Phishing simulation programme with metrics
Privacy Act 1988 (Cth) compliance, including Notifiable Data Breaches scheme readiness
Cyber-insurance policy in force, with its own renewal record

Evidence: IR plan document; exercise minutes; training completion register; Privacy Act Response Plan.

The controls insurers are tightening on hardest in 2026

Five controls consistently draw the most scrutiny, and are the ones worth pressure-testing first:

Machine-generated MFA evidence. Your organisation has to produce an export from the identity platform; an IT manager’s assurance no longer counts.
Restore-test logs. A scheduled test alone is no longer enough; underwriters increasingly look for a dated, documented, successful restore, commonly within the last ninety days.
Privileged account separation. “The office manager also has admin rights” is a common exposure that is now being specifically asked about.
External-sharing governance. Rising claim frequency attributable to over-sharing on collaboration platforms has made this a focused question.
Incident-response documented exercise. A plan on a shelf is no longer acceptable; the insurer asks when it was last exercised and who was in the room.

The practical test: could you answer these quickly?

If the underwriter called today and asked for evidence of these controls, how long would your organisation take to assemble it?

Under five business days. Excellent. This organisation has evidence infrastructure.
Five to ten business days. Acceptable. Some evidence is produced on request, rather than standing, but it exists.
Over ten business days. A red flag. Either the evidence does not exist, or it is held entirely by the MSP and your organisation cannot retrieve it without a service request.
Cannot answer. The renewal is exposed.

Find out which category your organisation is in before the renewal questionnaire arrives.

What to do, eight to twelve weeks before renewal

This is the window where remediation is possible without a loading.

Request the control questionnaire from your broker. Ask for the version the underwriter is currently using; the questions change from year to year.
Self-assess against each control. Mark each as green, amber, or red for evidence readiness — whether you could hand the underwriter the artefact today.
For every amber and red item, identify the owner. It will be one of: your internal IT lead, your MSP, or a third-party system vendor. Name the person.
For MSP-owned items, issue a written request. Ask for the evidence itself; a confirmation that the control exists will not satisfy the underwriter.
For items without evidence, produce it now. An MFA export, a conditional-access policy screenshot, a restore-test log.
Where the control itself is deficient, log it as a remediation item with a named date. Remediation is often a fortnight’s work once the scope is clear.
Ask your broker what the underwriter is most focused on this quarter. Your broker sees many renewals before yours; the pattern is visible from their seat.

The role of an independent reviewer

A broker’s job is to place the risk; a broker does not audit the controls. An MSP’s job is to operate the systems; the MSP is not the party to certify the quality of its own work. Internally, most SMEs do not have a dedicated person whose role is to produce and defend cyber-controls evidence.

The gap an independent reviewer fills is narrow but useful: produce the evidence, map it to the insurer’s current control set, identify the gaps, and give you something you can confidently put in front of your broker and underwriter.

At Adeo, that is the Cyber-Insurance Readiness Quick-Scan — a focused engagement, scoped in the written proposal, that produces a remediation roadmap your organisation can execute against. A Baseline Audit goes wider; a Quick-Scan is the more targeted option when a renewal is weeks away.

A board-level framing

For managing partners and board directors weighing whether any of this deserves their attention: the cost of a cyber-insurance loading is no longer trivial. For a mid-sized Australian professional-services firm, a loading can run to several thousand dollars a year. A decline is materially worse — the firm may find itself uninsured at a point where it has fiduciary and statutory obligations that cannot be discharged without cover.

The questions above are governance questions, put in a format where “the IT person is on top of it” is no longer an acceptable answer at the board table.

What this article does not cover

The specific questionnaires of individual insurers — those change frequently, and the practical detail belongs inside an engagement.
Incident response in flight (that is a different specialty; contact a specialist IR firm).
Specific vendor product recommendations — Adeo does not endorse or recommend vendors in external content.