Your Board Asked About the Cyber Insurance. Here Is How to Give Them a Real Answer.

The board wants a yes or a no on the cyber insurance. The honest answer is that you cannot give them one, and neither can your IT provider. Whether cover responds to a particular incident is the insurer's decision, made against the policy's own terms and the facts of the event. What you can put in front of a board is narrower and more useful: what the policy documents say, what was represented to the insurer when the cyber insurance was arranged, whether the environment still matches those representations, and what evidence exists today for each control that was claimed. Four things. All of them checkable. None of them a prediction.

It is an uncomfortable position. You are being asked to guarantee something you cannot personally verify, usually after someone in your industry got breached, or after this year's renewal form became a technical review. The board is right to ask. The question simply does not have a yes in it.

The reason is partly legal and worth saying plainly. inSUPPORT is not an insurer, insurance broker or underwriter and holds no Australian Financial Services Licence, so nothing below is advice about your policy. It is information about a process, and the process has a shape you can work with.

So the deliverable is not a reassurance. It is a documented position, plus a register of what is still unverified, with a name and a date on each line. Here is how to build it.

TL;DR: What to take to the board

• ✅ Nobody inside your business can answer the board's cyber insurance question with a yes. That call belongs to the insurer, against the policy terms and the facts of the incident. Saying so out loud is the start of a credible answer, not a dodge.
• ✅ Four things you can verify: what the policy documents say, what was represented when the cover was arranged, whether the environment still matches that, and what evidence exists for each control claimed.
• ✅ Accuracy is the lever you actually control. Under section 21 of the Insurance Contracts Act 1984 (Cth) the insured carries a duty of disclosure, and section 28 sets out what an insurer may do where a relevant failure has occurred.
• ✅ Grade your evidence the way an assessor would. The Australian Signals Directorate calls a policy or a verbal statement of intent Poor evidence, and keeps No visibility as an outcome in its own right.
• ✅ Table a position and a gap list, not an adjective. A board can govern an unverified item with an owner and a date. It cannot govern a feeling.

Contents

• Why neither yes nor no is an honest answer
• The four things a CFO can actually verify
• What to actually put in front of the board
• Questions CFOs ask before the board meeting

Why neither yes nor no is an honest answer

Three separate things decide what happens after an incident, and you control none of them. The policy wording decides what is in scope. The insurer's assessment decides how the claim is treated. The facts of the event decide which clauses are even reached. A chief financial officer can read the first, has no part in the second, and cannot know the third until it happens.

Which is why a confident yes at a board table is worse than useless. It converts somebody else's decision into your personal assurance, and the minute an incident tests it you own the gap between what you said and what the policy did. A flat no is no better. It tells the board nothing they can act on and quietly writes off cyber insurance the business is already paying for.

There is a third answer, and it is the one the question is really reaching for. The board is not asking you to underwrite the risk. It is asking whether anyone has checked, recently, that the company's environment still lines up with what the insurer was told about it. That one has a checkable answer. The Insurance Council of Australia is open about the fact that pricing cyber risk can require an insurer to reach into a client's data and IT processes and test their defences. Your environment is part of what was priced.

It helps to know the board is doing its job rather than second-guessing you. The Australian Institute of Company Directors publishes cyber governance principles for this exact conversation, with director questions and red flags, now in a second version released in November 2024. Expect the question again next year.

The four things a CFO can actually verify

None of the four needs a licence, a lawyer or a technical background. Three of them are reading and asking. The third is the one that takes real work, and it is the one that moves the conversation.

1. What the policy documents say, and who holds them

Start with the physical reality: who has the current policy schedule, the wording, and the proposal or renewal form that was submitted. If the form went back through a broker and nobody kept a copy, the company cannot see what it told the insurer. Get the set into one folder with a date on it. Everything after this step reads against that paperwork, so without it you are working from memory.

2. What was represented when the cover was arranged

Read the answers that were given, question by question, as statements of fact about your environment. Multi-factor authentication on remote access. Backups tested. Patching inside a stated window. Privileged accounts restricted. Whoever filled the form in may have answered for the intention rather than the configuration, and may not have been the person who could tell the difference. Our August piece on what an underwriter weighs before they cover a business explains why those particular questions are on the form in the first place.

3. Whether the environment still matches

Environments move. A new cloud service goes in without multi-factor authentication. A contractor keeps an administrator account after the project ends. A finance system gets excluded from the patch schedule because it broke once. Each of those is ordinary operational life, and each puts distance between the form and the facts. This is the check that has usually never been done, and it is the only one of the four that produces genuinely new information.

4. What evidence exists today for each control claimed

Not whether the control is believed to be on. Whether somebody can show it, now, from records that already exist. The Australian Signals Directorate grades evidence quality in its Essential Eight assessment process guide, and the bottom rung is blunt: a policy or a verbal statement of intent is Poor evidence. A configuration export is fair. Reviewing the live configuration is good. Testing the control is excellent. Our September piece on what an Essential 8 assessment actually involves works through those grades in detail. That guide was published in November 2022 and last reviewed on 2 October 2024, so check the current release before you quote it in a board paper.

Why accuracy is the lever, and not optimism

The statute is the reason this matters more than tidiness. Section 21 of the Insurance Contracts Act 1984 (Cth) places a duty on the insured to disclose, before the contract is entered into, every matter known to them that they know to be relevant to the insurer's decision, or that a reasonable person in the circumstances could be expected to know is relevant. Section 28 then sets out what follows where a relevant failure has occurred on a general insurance contract. A fraudulent failure may let the insurer avoid the contract. Otherwise the insurer's liability on a claim is reduced to the amount that would place it in the position it would have been in had the failure not occurred. Note which direction that runs. It is not a rule about how good your security is. It is a rule about whether what you said matched what was there. That is squarely inside your control, and it is the strongest thing you can tell a board.

What to actually put in front of the board

One page, four parts, and no adjectives. Part one: the represented position, meaning what the company told the insurer and when. Part two: the verified position, control by control, with the grade of evidence behind each line. Part three: the unverified list, every item nobody could confirm, each with a named owner and a date. Part four: the single sentence that says who answers the cover question, which is the licensed party arranging the cover and the insurer itself.

That fourth part is not a disclaimer. It is the governance point. An unverified item with an owner and a date can be tracked, closed and reported against. A yes cannot be governed at all. It can only be believed, and then regretted.

Expect the list to be uncomfortable the first time. It is still the better document, because the alternative is a board minute recording a confidence nobody checked. Date it. Note who verified each line. Then the next version starts from this one instead of from memory.

The technical half of this is ordinary work and it is where an IT provider belongs. inSUPPORT maintains the agreed controls and keeps the evidence current as part of The 6 Step Cyber Strength System. A Cyber Strength Audit produces what that page calls a documented audit trail: evidence you can hand to a board, an insurer or a client who asks. Where cyber insurance forms part of a plan it is arranged through licensed insurance partners and underwritten by the insurer, and cover is subject to the insurer's assessment. Wording, eligibility and claims sit with those licensed parties. The environment is the part we can put beyond argument.

Questions CFOs ask before the board meeting

Can our IT provider answer the board's question for us?

No, and a provider who says otherwise has told you something useful about themselves. An IT provider can state what is configured, show the evidence behind each control and say where it has no visibility. It cannot tell you how an insurer would treat a claim, because that sits with the insurer and the policy terms, and in Australia advising on an insurance product is licensed conduct. The useful division of labour is simple: the technical facts come from whoever runs your environment, and anything about the policy itself goes to the licensed party arranging the cover, and cover is subject to the insurer's assessment. Where cyber insurance forms part of an inSUPPORT plan, that conversation runs through inSUPPORT to the licensed insurance partners the cover is arranged through.

Do we need an independent review, or can our existing provider do it?

Either can work, and the question to ask is about evidence rather than independence. A provider who can produce configuration exports, restore test dates and access reviews from records that already exist is giving you something checkable, whoever employs them. The case for an outside read is strongest where the provider also filled in the form, where nobody has ever been asked for proof, or where the board wants a second set of eyes on the gap list. If you do go outside, ask for the evidence grade against every line, not a score.

How long does this take, and what does good look like?

It depends on the environment far more than on the paperwork. Gathering the policy documents and the submitted form is mostly a matter of waiting on other people. The technical verification is the real work, and the honest version of it finds things. Good does not mean a clean sheet. Good means every claimed control has an outcome against it, every gap has an owner and a date, and the document carries the date it was true.

The board meeting is in three weeks. Where do we start?

Start by asking one person for one folder: the current policy schedule, the policy wording, and the proposal or renewal form as it was submitted. Until that exists, nothing else can be checked. In parallel, ask whoever runs your IT for the evidence behind three controls: multi-factor authentication coverage, the date of the last tested restore and the current list of privileged accounts. Those two requests will tell you most of what you can say, and what you will have to list as unverified.

Citations

• "Insurance Contracts Act 1984 (Cth), Compilation No. 33", The source for section 21, the insured's duty of disclosure, and for section 28, which provides that a fraudulent relevant failure may allow the insurer to avoid the contract and that otherwise the insurer's liability on a claim is reduced to the amount that would place it in the position it would have been in had the failure not occurred. Also the source for the Act's Division 1A heading, which applies the duty to take reasonable care not to make a misrepresentation to consumer insurance contracts. Compilation date 8 October 2026, the latest compilation when checked on 21 October 2026. legislation.gov.au
• "Essential Eight assessment process guide, Australian Signals Directorate", The source for the four levels of evidence quality, where testing a control is Excellent evidence, reviewing a live configuration is Good, reviewing a copy of a configuration such as a report or screenshot is Fair, and a policy or verbal statement of intent is Poor evidence. Also the source for the standardised assessment outcomes, which include No visibility where an assessor could not obtain adequate visibility of a control. Published 24 November 2022, last reviewed 2 October 2024. cyber.gov.au
• "Cyber risk, Insurance Council of Australia", The insurance industry's own peak body, and the source for the statement that pricing cyber risk can require an insurer to reach into a client's data and IT processes and to test their cyber defences. The same page notes that this process can itself reveal weaknesses in a business's data protection and security practices. insurancecouncil.com.au
• "Cyber Security Governance Principles, Version 2, Australian Institute of Company Directors and the Cyber Security Cooperative Research Centre", The source for the existence and currency of Australian director-level cyber governance guidance, including tailored director questions and governance red flags. Version 2 published 25 November 2024. aicd.com.au

Related Reading

• What Underwriters Check Before They Cover an Australian Business
• The 6 Step Cyber Strength System
• Cyber Strength Audit
• What Your Provider Should Show You at an Essential 8 Review

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.