Astoundingly, the Australian Cyber Security Centre (ACSC) received more than 87,400 cyber crime reports in FY24 so many insurers now take a far more detailed approach to assessing business risk. The Australian Prudential Regulation Authority (APRA) has called out cyber resilience as a priority area, reinforcing the expectation that businesses maintain verifiable controls.

Strong cyber hygiene is no longer enough. Insurers expect evidence that controls are active, documented and maintained throughout the year. A clear readiness checklist helps businesses prepare for renewal, improves claim outcomes, and reduce the risk of unexpected gaps in cover.

Further, cyber insurance is playing an increasingly important role in financial protection. Rising incident rates mean insurers are examining how businesses manage identity, email, access, devices, backups, and staff behaviour. A proactive approach gives insurers confidence that your business takes risk seriously and can maintain operations if an incident occurs.

The following checklist outlines the documents, controls and evidence Australian businesses can prepare to strengthen their cyber insurance position.

Knowing what insurers look for

Insurers assess both your technical environment and internal processes. They want to see that the business follows documented practices backed by reliable tools and monitoring.

Renewal questionnaires often cover areas such as Multi Factor Authentication (MFA), patching, access management, email filtering, backups and staff awareness. Clear, current documentation and active controls give insurers a more accurate picture of risk. Businesses who have invested here are often viewed as more resilient and more likely to recover quickly so viewed favourably by insurers.

Documenting policies and procedures that insurers expect

Policies explain how your organisation manages cyber risk day to day. Many insurers request copies during underwriting or claims assessment.

Common documents include:

• A cyber security policy outlining how the business manages threats and responsibilities
• An acceptable use policy that sets standards for how staff handle systems and data
• An incident response plan detailing roles, communication actions and escalation paths
• A business continuity plan explaining how operations continue during disruption
• A data backup and recovery policy describing frequency and testing expectations
• Access management procedures documenting how staff receive and lose access

Policies need to be current, accessible and applied consistently. Insurers place weight on whether the business can demonstrate ongoing governance rather than a purely administrative set of documents.

Proving technical controls are active and effective

Insurers often request evidence that technical controls protect your systems reliably. These controls are not mandated for small businesses but are widely expected by insurers because they address the most common causes of cyber incidents.

Key controls insurers frequently check include:

• Multi-factor authentication across cloud services, email, finance platforms and administrator accounts
• Patch management that keeps operating systems and applications updated
• Endpoint protection across laptops, desktops and mobile devices
• Email security, including filtering, impersonation protection and DMARC alignment
• Firewall and network safeguards are monitored by an IT professional
• Privileged access controls limiting who can make system changes

Insurers may request screenshots, configuration summaries or audit reports. Logs confirming patch deployment, backup completion or MFA enforcement demonstrate that controls are active rather than theoretical.

Demonstrating secure backup and recovery capability

Backup and recovery capability is a core part of most insurance assessments. Insurers want confidence that the business can restore data quickly and minimise operational downtime.

A strong backup environment includes:

• Regular automated backups stored in isolated or cloud locations
• Retention settings that protect against accidental deletion or ransomware encryption
• Regular restoration tests documented in a report or log
• Clear procedures describing how data is recovered and who is responsible

Successful recovery tests help insurers understand that your business can resume operations without prolonged disruption.

Verifying staff readiness and reducing human risk

Human error remains a leading factor in cyber incidents. Insurers increasingly request evidence that staff receive regular cyber awareness training.

Relevant evidence includes:

• Logs from annual training sessions
• Results from phishing simulations
• Induction records showing that new staff complete awareness training
• Documentation explaining how staff report suspicious activity

A well-trained workforce reduces overall exposure and is viewed favourably during insurance assessments.

Managing vendor and supply chain risks

Insurers recognise that cyber incidents often occur through software vendors or suppliers. Many now ask how businesses manage third-party access and whether contracts address cyber responsibilities.

Useful evidence includes:

• A list of vendors with system or data access
• Agreements outlining security expectations
• Review schedules showing when supplier risks were last evaluated

Strong vendor management demonstrates that your organisation understands risk beyond internal systems.

Cyber frameworks strengthen insurance readiness

Several frameworks help Australian SMBs improve maturity in a structured way. The ACSC Essential Eight provides a simplified, outcome-based model for raising baseline cyber hygiene. The National Institute of Standards and Technology (NIST) Cybersecurity Framework is frequently referenced globally for risk assessment and control planning.

SMB1001 is a practical option for small and medium businesses seeking structure without overwhelming complexity. It aligns with Australian expectations and focuses on prioritised controls, documented processes and measurable improvement. Many organisations adopting SMB1001 find it easier to respond to insurer questionnaires because evidence is already captured, reviewed and maintained. As a trusted IT partner, The IT Agency makes implementing SMB1001 seamless and stress-free. Our SMB1001 services include 24/7 monitoring, proactive risk assessments, guidance and implementation support, and ongoing compliance management.

Creating an insurer-ready evidence pack

Preparing an organised pack of documents and records speeds up renewals and claims. It also helps leadership teams understand the maturity of their cyber posture.

A clear evidence pack often includes:

• Key policies and procedures
• Backup logs and recovery test reports
• Patch and update summaries
• MFA enforcement settings
• Antivirus and endpoint management reports
• Training logs and phishing simulation results
• A record of administrator accounts and access reviews

Collecting evidence quarterly avoids the stress of gathering information during a renewal or after an incident. A prepared organisation demonstrates lower risk, stronger recovery capability and greater alignment with insurer expectations.

The IT Agency helps keep businesses connected, protected, productive and supported with managed IT solutions that deliver real business outcomes. Talk to the team about how we can secure your systems, simplify your IT and strengthen your business resilience today.

In summary

• Insurers look for documented processes and active controls that demonstrate cyber maturity
• Policies, procedures and evidence of technical safeguards help insurers assess risk accurately
• Staff training and secure access practices reduce human error and strengthen everyday protection
• Regular backups, vendor oversight, and an organised evidence pack support faster renewals and smoother claims

References

Australian Cyber Security Centre (ACSC). (2024). Annual Cyber Threat Report 2024–2025. Available at: https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025 (Accessed: 2 December 2025).