The Cyber Insurance Renewal Questionnaire Got Harder. Here Is How to Answer It Honestly.

Answer it from evidence, not from memory. A cyber insurance renewal questionnaire reads like a technical review, with a signature on the end of it. So sort the questions into three kinds, then settle the environment ones against something you can see on a screen. inSUPPORT has run more than 1,500 cyber audits for Australian businesses. Below are eight control questions, what each one is really establishing, and the evidence that settles it.

The discomfort is not really about the technology. It is about putting your name to something you cannot personally verify. Somewhere in the pack there is a declaration, and the person who signs it is you, not your IT provider.

Most of the form is factual, which is better news than it feels like. Whether multi-factor authentication is enforced on remote access is not an opinion. Whether a restore has been tested, and when, is a date. Those answers already sit in a console, a log or a report. What an insurer then does with them is the insurer's assessment. That part was never yours to predict.

The hard questions are the other ones. What you know, what has happened to you before, and who else can reach your systems. Those belong with your finance team and the people in the business who would actually know, and no IT provider can answer them for you, however good its records are.

TL;DR: Before you fill in a single box

• ✅ Sort the pack before you answer it. Environment questions you can check, business questions finance owns, and knowledge questions that ask what you are aware of.
• ✅ Eight control questions do most of the work. Each one has a screen, a date or a log behind it, and a yes is a scope statement, so name what it covers.
• ✅ ASD's assessment guidance recognises a documented exception. It wants compensating controls, a named risk owner and a review, and says exceptions should not be approved beyond one year.
• ✅ The framework language is moving. ASD launched the ASD Essentials on 15 October 2026. Both it and the Essential Eight stay maintained through the transition.
• ✅ You sign the declaration, not your IT provider. Read it first, because it names who is answerable for the pack.

Contents

• Sort the Pack Before You Answer Anything
• Work the Eight Control Questions One at a Time
• Then the Questions Nobody in IT Can Answer for You
• What to Do With the Weeks You Have Left
• The Framework Your Form Quotes Is Changing
• Questions Finance Leaders Ask About the Renewal Questionnaire

Sort the Pack Before You Answer Anything

Read it once without answering anything. You are looking for three kinds of question, and each kind has a different owner and a different sort of proof behind it. The pack is a mixed one, and treating it as a single job is what makes it feel impossible.

Environment questions ask what is configured. Is multi-factor authentication enforced, what is the patch window, when was the last restore tested. Every one of those has an answer sitting in a console or a report, and every one can be checked rather than recalled.

Business questions ask about the business. Turnover, headcount, the records you hold, your reliance on a single customer or system, the downtime you could absorb. Finance and operations hold those numbers. An IT provider estimating them is how a pack ends up confidently wrong.

Knowledge questions are the quiet ones. They tend to begin with the words are you aware of. They ask what you know rather than what is installed, so they go to the people who would know. It helps to read what underwriters check before they cover an Australian business before you start, because knowing what the other side is weighing makes the wording stop looking arbitrary.

Then find the declaration at the back and read it before you start. It names who is answerable for the pack. Australian insurance law places a duty of disclosure on the insured, under the Insurance Contracts Act 1984, which is why accuracy here is not a matter of presentation. What the duty requires in your circumstances is a question for your licensed insurance adviser and the insurer, not for an IT provider.

Work the Eight Control Questions One at a Time

These are the questions your own records can settle, so work them in the order below. Start with the first four, because they are the quickest to verify. Write down what is true, including the parts that are unfinished.

A lot of this wording sits on top of the eight mitigation strategies the Australian Signals Directorate (ASD) publishes as the Essential Eight. ASD's Essential Eight maturity model spells out what each control requires, and it is far more specific than the single line a form gives it. A questionnaire asking do you use multi-factor authentication is reaching for several separate requirements at once. That is why a bare yes is hard to stand behind.

1. Is Multi-Factor Authentication Enforced, and on What?

The question is about scope, not about whether the feature exists. At Maturity Level One the maturity model asks for multi-factor authentication in several places: your organisation's own online services that handle its sensitive data, third-party online services that handle it, and online customer services handling sensitive customer data. One line on a form is asking about all of that.

What settles it is the policy in your identity platform, read on screen, then the list of accounts and applications it actually applies to. Look at the exclusions, because that is where the real answer lives. Service accounts, a legacy application and the one director who was exempted are the usual residents.

If it is partial, say which systems are covered and which are not. Name the one you already know is the problem. For the longer version, the gap Australian businesses still have on multi-factor authentication explains why that is where it tends to sit, rather than in the rollout.

2. Where Are the Backups, and When Did a Restore Last Work?

Two questions wearing one coat. The first asks whether a copy exists somewhere an attacker holding your administrator rights could not reach. The second asks whether anybody has proved it comes back.

The maturity model is direct on both. Backups are retained in a secure and resilient manner, and unprivileged accounts cannot modify or delete them. Restoration to a common point in time is tested as part of disaster recovery exercises, so the evidence is the date of the last test restore and what came back from it. A green tick on last night's job proves the software ran.

An untested restore is one of the better gaps to be honest about, because it is a date you can create inside a fortnight. There is more on what a test restore has to include in how you would know your backups would actually restore.

3. Do You Run Endpoint Detection and Response, and Who Reads It?

The question has two halves and a form will often only ask the first. Holding the product is a procurement fact. Having somebody who acts on what it says at two in the morning is an operating fact, and that is the half that changes how an incident goes.

Answer with the product, the proportion of devices it is genuinely installed on, and the arrangement for alerts outside business hours. If alerts land in a shared mailbox nobody owns, write that down, because describing the intention instead is how a yes stops being true.

Either way, describe it exactly rather than approximately. Precision here also tells whoever reads the form that the rest of your answers were written the same way. An alert nobody reads is a finding you can act on, not just a box you cannot tick.

4. What Is Your Patch Window, and What Is Already Unsupported?

The form wants a timeframe, and the maturity model supplies the ones the question is measured against. At Maturity Level One, patches or vendor mitigations for vulnerabilities in online services are applied within 48 hours of release where a vendor assesses them as critical or a working exploit exists, and within two weeks where they do not. One month applies to the operating systems on workstations and non-internet-facing servers.

What settles it is the patch report with dates on it, then a separate list of anything the vendor no longer supports. The maturity model's answer to unsupported software is removal, and to an unsupported operating system, replacement.

If something genuinely cannot be patched, that is not automatically a no. ASD's assessment process guide recognises a documented exception, and it wants compensating controls, a named risk owner and a scheduled review. It also says exceptions should not be approved beyond one year. Write the exception, not the silence.

5. Is Anything Reachable From the Internet That Should Not Be?

This is the question about remote desktop, management interfaces, and firewall rules somebody added for a project that finished years ago. It asks whether a stranger can knock on a door directly, instead of going through something that checks who they are.

Read an external scan beside the current rule set. The rule set tells you what was intended and the scan tells you what is true. Where they disagree, the scan wins, and the honest answer is the finding plus the date it is being closed.

Writing it down is also how it gets closed. An exposed service nobody has named tends to stay exposed.

6. Who Holds Administrator Rights, and Over What?

Export the list of administrator accounts and read the names. Count how many belong to people who have left or never needed the rights, then read what those accounts can reach, because the count matters less than the reach.

The question is there because one compromised privileged account can do far more damage than one compromised ordinary account. The maturity model asks for three things: privileged access validated when it is first requested, a dedicated account each privileged user holds solely for that work, and privileged accounts kept away from the internet, email and web browsing.

A list longer than you expected is the easiest answer on this form to improve. Shortening it is a change you can make this week without buying anything, and before the form is submitted.

7. What Happens When a Supplier Emails New Bank Details?

Not a technical control, and if it is on your form it is there for a blunt reason. Can a payment be redirected by an email.

The answer it reaches for is a named procedure. A callback on a number you already held, a second approver above a stated amount, and no change to payment details on the strength of an email alone. The evidence is the written procedure, who it applies to, and the last time it stopped something.

If the procedure lives in one person's habits, write that down. A habit is not a control, and the gap between the two is precisely where invoice fraud lands.

8. Is There an Incident Response Plan, and When Was It Last Used?

Again two questions: whether a plan exists, and whether anyone has walked through it. A plan nobody has rehearsed is a document.

Bring three things to the form: the plan, the date of the last walkthrough, and the name of the person who can declare an incident at any hour. Add the reporting obligations the plan works to. Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act 1988 must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm to an individual whose personal information is involved. So the plan needs to know that clock exists.

No plan yet means writing a short one. Four pages naming the decisions, the order services come back in, and the contacts will serve you better than forty nobody finishes.

Then the Questions Nobody in IT Can Answer for You

Three groups of questions are not about your environment at all. Sending them to your IT provider is how a pack ends up accurate in the technical half and wrong in the other.

The first is the business picture: turnover, employee numbers, the volume and type of records you hold, your reliance on any single customer or system, and the downtime you could carry. Finance and operations hold those, so take them from the source rather than from last year's pack. A figure copied forward is a figure nobody has checked.

The second is history. Previous incidents, previous claims, and the questions asking whether you are aware of any circumstance that might give rise to one. These ask what people in the business know. That is why they go to those people and not to a console. Where an incident was notified to the OAIC, it is a matter of record and should be treated as one.

The third is dependency. Who else can reach your systems, your IT provider included. Which suppliers you could not operate without for a week. The 6 Step Cyber Strength System runs the IT, the control maintenance and the insurance coordination as one model, and part of the reason is to make this question answerable in one place instead of three.

Everything in this group that touches the insurance itself belongs with the licensed insurance adviser who arranged the policy: the wording, the disclosure duty, what any term in the pack means. Where cyber insurance forms part of a plan it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment.

What to Do With the Weeks You Have Left

Order matters more than effort. Sorting, checking and closing are three different activities, and they want three different parts of the calendar.

The first pass is the read and the sort, and nobody answers anything, so you come out of it with three lists and a named owner for each. The second pass is evidence. Every environment question gets looked at rather than recalled, and the answer is written down with the thing that proves it beside it. This is where you find out which answers you only thought were yes.

Only then is it worth asking what can change. Administrator rights, a missed multi-factor authentication rollout, a test restore, an exposed service and a written payment-verification procedure are all days of work. Application control across a whole fleet, or replacing an unsupported platform, is not. Claiming otherwise on a form is worse than scheduling it.

For anything in the second group, write the plan rather than the intention: the control, the owner, the date, and the compensating control holding the line until then. That is the shape ASD's own assessment guidance recognises. It reads as a position rather than an excuse.

Most of the eight questions above can be settled by looking rather than guessing. Somebody just has to look.

The Framework Your Form Quotes Is Changing

One more thing, before you answer a form written in framework language. On 15 October 2026 the Australian Signals Directorate launched the ASD Essentials, which it describes as an evolution of the Essential Eight. The first three chapters cover enterprise IT, operational technology and cloud, and the enterprise IT chapter is the one that evolves the Essential Eight itself. ASD's own FAQ says the Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations, and that small and medium sized businesses can still use the guidance where relevant.

Two things follow for anybody answering a questionnaire this renewal. ASD says it will keep maintaining both frameworks on cyber.gov.au during the transition, along with the supporting resources and implementation guidance. So the Essential Eight wording on your form has not stopped meaning anything. And ASD's own instruction is that organisations should continue to meet their current regulatory obligations until regulators communicate the associated changes.

So answer the form in the language the form uses. If it asks about Essential Eight maturity, answer about Essential Eight maturity. Keep the scope and the evidence attached, as above. If a question turns on which version of a framework is meant, ask whoever sent you the form.

This section is current as at 20 October 2026. Framework guidance is moving, so check cyber.gov.au before relying on the detail at a later renewal. inSUPPORT aligns client environments to the compliance frameworks that apply to their industry, with the Essential Eight as the named baseline inside that set.

Questions Finance Leaders Ask About the Renewal Questionnaire

What do we write when the honest answer on a cyber insurance renewal questionnaire is no?

Write no, then write the position around it. Name the scope, so it is clear what is covered and what is not. Add the planned control, the person who owns it, and the date it lands. Add the compensating control holding the line until then, which is the shape ASD's assessment guidance recognises for a documented exception. An answer built that way describes a managed risk rather than a hole.

Should our IT provider fill in the questionnaire for us?

They should supply the evidence, not sign the form. An IT provider can read the configuration, export the account lists, produce the patch report and date the last tested restore. That is the part nobody can do from memory. What they cannot do is answer for your turnover, your records, your claims history or what your people know. They cannot carry the declaration either, so split it three ways. Your provider answers the environment questions with proof attached, finance answers the business questions, and whoever is named on the declaration reads the whole pack before it goes anywhere.

How long before renewal should we start, and what can realistically change in that time?

Start when the pack arrives, not when it is due. Gathering the evidence takes longer than writing the answers. A fortnight is a realistic allowance for sorting the questions, checking the environment ones and getting the numbers out of finance. Whatever time is left after that is for the days-of-work fixes set out in the section on the weeks you have left. Close those before you submit, and put the projects on the form as a dated plan.

What is the first step if we have never answered this from evidence before?

Get an independent read of the environment before you answer anything, so the form is filled in from a current record instead of last year's pack. A Cyber Strength Audit documents the position control by control and comes back as a plain-English report with a costed path to closing each gap. That covers the environment questions. The business questions still go to finance.

Citations

• "Essential Eight assessment process guide, Australian Signals Directorate", ASD's process for assessing both the implementation and the effectiveness of the Essential Eight controls. The source for assessors gathering the highest quality evidence that is reasonably practicable, and for the exception process: documented exceptions with compensating controls, a risk owner, acceptance by an appropriate authority, and exceptions not approved beyond one year. Published 24 November 2022, last reviewed 2 October 2024. cyber.gov.au
• "Essential Eight maturity model, Australian Signals Directorate", The source for what the individual controls require at Maturity Level One: the scope of multi-factor authentication across an organisation's own and third-party online services, backups retained securely with restoration tested as part of disaster recovery exercises and protected from unprivileged accounts, dedicated privileged accounts kept off the internet and email, and the 48 hour, two week and one month patch windows quoted above. Last reviewed 27 November 2023. cyber.gov.au
• "ASD Essentials: evolving our approach to cyber security resilience, Australian Signals Directorate", The 15 October 2026 announcement of the ASD Essentials as an evolution of the Essential Eight, its first three chapters for enterprise IT, operational technology and cloud, ASD's commitment to maintain both frameworks on cyber.gov.au during the transition, and its instruction that organisations continue to meet their current regulatory obligations until regulators communicate the associated changes. asd.gov.au
• "Frequently asked questions: ASD Essentials, Australian Signals Directorate", The source for who the Essentials series is written for: primarily Commonwealth entities, critical infrastructure owners and operators, and large organisations, with small and medium sized businesses able to use the guidance where relevant. Published and last reviewed 15 October 2026. cyber.gov.au
• "About the Notifiable Data Breaches scheme, Office of the Australian Information Commissioner", The source for the notification duty referenced in question eight: an organisation or agency covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to an individual whose personal information is involved. oaic.gov.au

Related Reading

• What Underwriters Check Before They Cover an Australian Business
• The 6 Step Cyber Strength System
• Cyber Strength Audit
• What Does an Essential 8 Assessment Actually Involve?
• How Do You Know Your Backups Would Actually Restore?

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.