What Does a Cyber Insurer Actually Want to See Before They Quote You?

A cyber insurer wants to see your environment as it stands today, control by control, with dates against it and a name attached. Not your intentions. On the Insurance Council of Australia's account, an insurer writing cyber cover needs access to the client's data and IT processes, and may test the defences, before it can price the risk. Most of that access starts with what you hand over. They can only price what they can actually see.

You may be meeting this with the form already in front of you. The questions are specific and technical. The answers live in four different systems, and the person who has to sign the form may not be the person who knows. That is an awkward place to be sitting, and most of the way out is pulling those answers into one place before the form needs them.

The insurer can test the controls, and it will read the record. The record is the part already in your hands before the question comes. A control that is running and a control you can show somebody are two different things, and only one of them survives a question from an underwriter.

So this is about the pack, not the policy. What an insurer is pricing, what the evidence behind it now has to prove, and who has to put their name to it.

TL;DR: What to remember

• ✅ What you hand over is what gets priced. The Insurance Council of Australia says insurers need access to a client's data and IT processes, and may test its defences, to price cyber risk.
• ✅ Three properties make a record usable: it is current, its scope is written down, and the system produced it rather than somebody's memory.
• ✅ The standard applied to control evidence moved on 15 October 2026. ASD's transition guidance has assessors weighing coverage, consistency, currency and evidence quality, and says evidence of deployment may not show that a control keeps working.
• ✅ The insured signs the form, not the IT provider. The duty to disclose applies again before you renew, extend, vary or reinstate a policy.
• ✅ A gap you have decided to live with still gets written down. ASD's own exception process names the compensating controls, records who accepted the residual risk, and sets a review date.

Contents

• What an insurer is actually pricing
• The bar on control evidence moved in October 2026
• Who signs it, and why that decides what you can write
• Questions Australian businesses ask about the evidence an insurer wants

What an insurer is actually pricing

Every question on a cyber insurance proposal form is a request for a record. "Is multi-factor authentication enforced" is really "show me which accounts it applies to, and tell me when that was last true". Access is the operative word in the Insurance Council's description of the job. Nobody on that side of the table is collecting opinions. They are pricing a thing they can look at.

The pack is not a folder you write from scratch the week before a renewal. It is mostly what your environment already produces, gathered up and dated. The identity platform knows which accounts enforce a second factor. The patching tool knows what is behind. The backup system knows when a restore was last tested and whether it worked. A business with those exports to hand is answering from records. A business without them is answering from memory. Memory is generous about itself.

inSUPPORT's own audit page puts the output as evidence you can hand to a board, an insurer or a client who asks. That is the test worth applying to anything in your folder. If it needs you in the room to explain it, it is not evidence yet. It is a note. The 6 Step Cyber Strength System builds the record as part of the audit rather than assembling it under deadline. That is the only way it ends up dated and scoped.

Three properties decide whether a record is usable to somebody who was not there.

• Current. Dated, and recent enough to describe the environment you are running now. An export from eighteen months ago describes a business that has since changed staff, devices and suppliers.
• Scoped. It says what it covers and what it does not. "Required for every staff sign-in, with two service accounts exempt and listed" is a record. A bare yes is not.
• System-produced. Exported from the thing that actually enforces the control, rather than typed up afterwards by the person who believes it is on.

The pack, record by record

Gathered into one place, the pack is five records, and each one carries a date and a scope.

• The multi-factor authentication export, showing which accounts enforce a second factor and where it is not yet enforced.
• The patching report, with timeframes against it.
• The last restore test, with when it ran and what came back.
• The incident response plan, and when it was last exercised.
• The exception register: each gap you have decided to live with, its compensating controls, who accepted the residual risk, and its review date.

The bar on control evidence moved in October 2026

On 15 October 2026 the Australian Signals Directorate (ASD) published guidance on transitioning from the Essential Eight to ASD Essentials for enterprise IT. In ASD's own framing, it has evolved the Essential Eight into the new framework, and one part matters here. Existing evidence carries forward, ASD says, where it remains current and relevant, and an assessment now weighs coverage, consistency, currency and evidence quality when it rates an action. Where the evidence shows a control was deployed but not that it keeps working, ASD says further operational evidence may be needed. That means control validation, testing, exercise results or monitoring records.

Now the honest caveat. That guidance is written for organisations that already implemented the Essential Eight, and ASD lists its audience as large organisations, critical infrastructure and government. It also says an organisation that has not implemented the Essential Eight can implement the new chapter directly. ASD's own FAQ says the Essentials series is written primarily for Commonwealth entities, critical infrastructure and large organisations, and that small and medium businesses can still use it where relevant. The Essential Eight remains published. The Insurance Council of Australia still endorses the maturity model as a good first step for businesses, and particularly for small and medium enterprises. Nothing in the new guidance speaks to a renewal questionnaire.

The direction is the point. Deployment used to be the answer. Durability is becoming the answer. A question about when a restore was last tested is a question about durability. The five factors an underwriter weighs around that evidence are set out in what underwriters check before they cover an Australian business.

• Evidence of deployment answers "was it turned on". Evidence of effectiveness answers "is it still doing the job". Monitoring records and test results are the second kind.
• Currency is now explicit. A record that was true once is not a record that is true, which is why the date on an export does half the work.
• What an Essential 8 assessment actually involves is still a practical way for an Australian business to get a defensible position written down, and that work does not go in the bin.
• Framework guidance is moving underneath all of this. Treat this section as the position at 21 October 2026, and read it again before your next renewal.

Who signs it, and why that decides what you can write

The insured signs the proposal. Not the IT provider, and not the engineer who configured the tenancy. Under the Insurance Contracts Act 1984 the duty for a business policy is to disclose the matters you know that are relevant to the insurer's decision to insure you, and on what terms. Relevant means relevant as you know it to be, or as a reasonable person in your position could be expected to know it to be. The Act treats a renewal, extension, variation or reinstatement as entering into the contract again, so the same duty applies each time. A failure to disclose lets an insurer cancel the contract or reduce the amount it pays on a claim. The signature is the reason the record has to be exact.

Which is worth dividing up before the deadline rather than during it. Three jobs, and the trouble usually starts when one person tries to hold all three.

• The IT provider states what is configured, with scope and dates against it. Those are facts about the environment, and they are checkable.
• A director or officer signs, because the duty sits with the insured. ASIC frames cyber risk as something to be managed within the risk tolerance of senior leadership and boards.
• The licensed party arranging the cover owns the policy itself: the wording, eligibility, and what happens at a claim, and cover is subject to the insurer's assessment. Where cyber insurance forms part of the plan, that conversation runs through inSUPPORT to the licensed insurance partners the cover is arranged through.

Writing down the gaps you live with

One documentation gap is worth knowing about before you assume your own house is tidy. ASIC ran a cyber pulse survey of corporate Australia and reported it in November 2023, as a voluntary self-assessment. Of the participants, 33 per cent did not have a cyber incident response plan, and 20 per cent had not adopted a cyber security standard. ASIC's chair added that having plans in place is not enough, and that they have to be tested regularly. A plan nobody has exercised is a document. An underwriter asking about incident response is asking which one you have.

Record the gap you have decided to live with, too. ASD's exception process is a reasonable model for any business. Document the gap and its scope, name the compensating controls, record who accepted the residual risk, and set a date to look at it again. ASD's own rule is that an exception should not be approved beyond one year.

Questions Australian businesses ask about the evidence an insurer wants

What evidence does a cyber insurer actually accept?

The insurer decides that, and the answer varies by insurer and by product. What holds up generally is a record the system produced, with its scope written down and a date on it. Think of an export showing which accounts enforce a second factor, a patching report with timeframes against it, or the result of a restore somebody actually ran. The weakest material is a description of intent, because a description is not something anybody can access or test.

Can our IT provider just fill in the questionnaire for us?

They can supply the facts, and they should, because the facts are about systems they administer. They cannot sign it for you. The duty to disclose sits with the insured. So the useful shape is a provider statement an officer can read, check and stand behind. Not a completed form handed back for signature. Some questions are really about the policy rather than the environment, such as the meaning of a defined term in the wording. Those belong with the licensed party arranging the cover.

How long does it take to get the evidence together?

Less time than the dread suggests, and the length of it is set by your systems rather than by you. Where identity, patching and backup are centrally managed, the exports are a short job. Where there are three unconnected tools and no asset register, it is a longer one, and how long it takes is itself a finding worth reporting upward. An audit that documents the position is scoped to the environment for the same reason.

Where do we start if the renewal is six weeks away?

Start with last year's answers, not with this year's form. Read what was submitted, then check each answer against what the systems say now, and write down every place the two have drifted apart. Staff change, devices change and suppliers change, so drift follows, and finding it early is the whole exercise. Where the honest position has moved, you want it recorded with a scope, an owner and a date before the form goes back, not discovered afterwards. If nobody internally can produce that comparison, an independent look at the environment will give you the factual half of it in writing.

Citations

• "Transitioning from the Essential Eight", Australian Signals Directorate, published and last reviewed 15 October 2026. The source of the statement that ASD has evolved the Essential Eight into ASD Essentials for enterprise IT, that existing evidence can be reused where it remains current and relevant, that an assessment considers coverage, consistency, currency and evidence quality, that evidence of deployment may not demonstrate sustained effectiveness, and of the stated audience of large organisations, critical infrastructure and government. cyber.gov.au
• "Cyber risk", Insurance Council of Australia. The source of the statement that insurers need to access their client's data and IT processes and potentially test their cyber defences to analyse and price the risk, and of the Insurance Council's endorsement of the Essential Eight Maturity Model as a good first step for all businesses and particularly for SMEs. Read 20 October 2026. insurancecouncil.com.au
• "ASIC calls for greater organisational vigilance to combat cyber threats", Australian Securities and Investments Commission, media release 23-300MR, 13 November 2023, reporting Report 776 Spotlight on cyber. The source of the voluntary self-assessment finding that 33 per cent of participants did not have a cyber incident response plan and 20 per cent had not adopted a cyber security standard, and of the chair's statement that plans must be tested regularly and that cyber risk should be managed within the risk tolerance of senior leadership and boards. asic.gov.au
• "Essential Eight assessment process guide", Australian Signals Directorate, published 24 November 2022 and last reviewed 2 October 2024. Cited here for the exception process only: that exceptions and their compensating controls are documented with scope and justification, that an appropriate authority accepts the residual risk, and that exceptions should not be approved beyond one year. cyber.gov.au
• "Insurance Contracts Act 1984 (Cth), Compilation No. 33", The source for section 21, the insured's duty of disclosure, and section 20E, which applies that duty to contracts that are not consumer insurance contracts; for section 11(9), under which renewing, extending or varying a contract, or reinstating a previous one, counts as entering into a contract of insurance; and for section 28(3) and section 60(1)(b), under which a relevant failure reduces the insurer's liability on a claim or lets it cancel the contract. Compilation date 8 October 2026, the latest compilation when checked on 21 October 2026. legislation.gov.au
• "Frequently asked questions", Australian Signals Directorate, published and last reviewed 15 October 2026. The source of the statement that the Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations, and that small and medium sized businesses can still use the guidance where relevant. cyber.gov.au

Related Reading

• The 6 Step Cyber Strength System
• What Underwriters Check Before They Cover an Australian Business
• What Actually Happens in a Cyber Strength Audit
• What Does an Essential 8 Assessment Actually Involve?

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.