Cyber insurance readiness guide
Cyber Insurance Guide: Controls, Evidence and Questions to Consider
Cyber insurance may help organisations manage certain financial consequences of cyber incidents. Coverage, exclusions, conditions and claims decisions vary by policy and insurer. This guide explains common cybersecurity readiness considerations, not which policy you should buy.
Important: CyberCrunch provides cybersecurity readiness guidance, not insurance, legal or financial advice. Discuss policy wording, disclosure obligations, coverage, exclusions, premiums and claims with an appropriately licensed broker, insurer or legal adviser.
What cyber insurance is
A financial risk transfer tool, not a security control.
Cyber insurance is a specialised insurance product that may respond to certain cyber related costs, losses or liabilities within the terms of a policy. It does not prevent incidents and should sit alongside practical cybersecurity, incident planning and business resilience.
First-party response
A general term for insured costs or losses incurred directly by the insured organisation. The actual policy determines which events and costs qualify.
Third-party liability
A general term for claims or liabilities involving customers, partners or other parties. Coverage depends entirely on the wording and circumstances.
Possible response areas
Areas a cyber policy may address.
Availability, definitions, sublimits, waiting periods, conditions and exclusions vary. These examples do not confirm coverage.
Incident response
Access to approved response providers or reimbursement of specified response costs.
Forensic investigation
Investigation services used to understand the nature and extent of an incident.
Legal and privacy support
Approved legal advice and privacy-response assistance under policy terms.
Business interruption
Defined losses resulting from covered interruption, subject to calculations and waiting periods.
Data and system restoration
Specified recovery or restoration costs associated with a covered event.
Cyber extortion
Response costs or payments where lawful and covered, subject to strict conditions.
Notifications and communications
Approved customer, regulator or public-relations activities following an event.
Third-party liability
Specified claims involving other parties, subject to policy definitions and exclusions.
Questions for your adviser
Read the wording, conditions and exclusions carefully.
Rather than relying on a generic exclusions list, ask the broker or insurer how the proposed wording handles the areas relevant to your organisation.
Security-control conditions
Which controls must be implemented, maintained or disclosed?
Prior incidents
How are known circumstances, previous incidents or existing weaknesses treated?
Social engineering
How are payment fraud, impersonation and business email compromise defined?
Ransomware and extortion
What permissions, legal restrictions, sublimits or notification steps apply?
Business interruption
How are interruption, waiting periods, loss calculations and dependent providers defined?
Sublimits
Do particular response areas have lower limits than the overall policy limit?
Third-party providers
How are cloud, technology and outsourced service incidents addressed?
Territorial limits
Which locations, entities, systems and legal jurisdictions are included?
Notification and consent
When must the insurer be contacted, and which providers or actions require approval?
The questionnaire process
Begin with the actual documents and deadline.
Current questionnaire
Use the insurer’s current application, renewal form or security declaration.
Previous answers
Reassess earlier responses after changes to systems, staff, suppliers or operations.
Policy conditions
Identify relevant security requirements and questions for the broker or insurer.
Submission deadline
Allow time for evidence collection, clarification and possible remediation.
Entities and systems
Confirm which organisations, locations, users and technologies the answers cover.
Evidence ownership
Assign people to gather, validate and approve supporting information.
Common control questions
Understand the scope behind a simple answer.
Insurers do not all ask the same questions or use the same definitions. Common topics may include:
MFA coverage
Which users, administrators, remote-access services and critical systems use MFA?
Privileged and remote access
How are elevated privileges, external access and account lifecycles controlled?
Backups and recovery
What is backed up, how it is protected and whether recovery has been tested?
Patching and vulnerabilities
How are relevant vulnerabilities identified, prioritised and addressed?
Endpoint protection
Which devices are covered, monitored and managed?
Incident response
Is there a current, usable plan with contacts, escalation and testing?
Security awareness
Which people receive training, how often and what evidence is retained?
Cloud and suppliers
Which controls are operated internally and which depend on third parties?
Evidence checklist
Prepare material that supports approved responses.
- MFA configuration and coverage information
- User and administrator account records
- Backup scope and restoration-test records
- Patch and vulnerability reports
- Endpoint-protection coverage information
- Incident-response plan and exercise records
- Relevant security policies
- Awareness-training records
- Supplier and cloud responsibility information
- Previous questionnaire and final approved responses
Application accuracy principle
Support each material answer with evidence.
Do not answer “yes” based only on intention, partial deployment or assumptions. Confirm the scope of the question and retain evidence supporting the approved response.
The applicant remains responsible for reviewing, approving and submitting answers. Insurance interpretation should be referred to the broker or insurer.
Preparation timeline
Maintain readiness before the deadline arrives.
Before receiving a questionnaire
- Maintain controls and evidence
- Review incident contacts
- Test recovery
- Track security exceptions
When it arrives
- Confirm deadline and scope
- Assign technical and approval owners
- Clarify ambiguous questions
- Identify evidence gaps
Before submission
- Validate approved responses
- Record assumptions and scope
- Refer policy questions to advisers
- Retain the final response and evidence
Essential Eight overlap
Related control topics do not make the assessments interchangeable.
Some insurance questions overlap with Essential Eight strategies, particularly MFA, patching, administrative privileges and backups.
An Essential Eight assessment does not automatically satisfy an insurer’s questionnaire. An insurance-readiness review is also not an Essential Eight maturity assessment. Each engagement uses its own scope, evidence and purpose.
Specialist roles
Direct each question to the right adviser.
| Need | Appropriate role |
|---|---|
| Policy terms, limits, premiums and application interpretation | Appropriately licensed broker or insurer |
| Disclosure, regulatory and legal questions | Qualified legal adviser |
| Control operation and technical evidence | Cybersecurity provider and system owners |
| Emergency and forensic capability | Approved incident-response and forensic specialists |
| Financial risk and business impact | Appropriately qualified accountant or financial adviser |
Readiness self-check
Questions to ask before submission.
This checklist supports preparation only. It does not determine policy eligibility or coverage.
- Can every material security answer be supported?
- Are controls applied across the full stated scope?
- Are backup recoveries tested?
- Is MFA coverage clearly known?
- Are privileged accounts reviewed?
- Is the incident plan current and accessible?
- Are security exceptions documented?
- Have prior answers been reassessed after changes?
- Is responsibility for approval and submission clear?
- Has specialist advice been sought where needed?
CyberCrunch readiness pathways
Choose technical preparation based on the immediate need.
Cyber Insurance Readiness Review
Review a specific questionnaire, available evidence, unsupported answers and remediation priorities.
Cyber Risk Health Check
Begin with broad risk visibility when there is no current questionnaire.
Essential Eight Readiness Assessment
Use a framework-specific review where the Essential Eight is an explicit requirement.
Incident Response Planning Workshop
Create roles, escalation, first-hour checklists and scenario playbooks.
Frequently asked questions
Common cyber insurance readiness questions.
Does cyber insurance cover ransomware?
Some policies may address aspects of ransomware response or extortion, subject to wording, law, conditions, exclusions and sublimits. Ask the broker or insurer about the proposed policy.
Does it cover business email compromise?
Coverage for social engineering, payment fraud and business email compromise varies significantly. Confirm definitions, limits and conditions with the broker or insurer.
Will MFA guarantee coverage?
No. MFA is one possible underwriting topic. Eligibility and terms depend on the insurer, policy and full risk information.
Can an insurer deny a claim?
Claims decisions depend on facts, policy wording, disclosure and applicable law. Obtain advice from the insurer, broker or qualified legal adviser.
Can CyberCrunch recommend a policy?
No. CyberCrunch provides cybersecurity readiness guidance. Policy recommendations require an appropriately licensed insurance professional.
Can CyberCrunch complete our questionnaire?
We can review technical questions and evidence. The authorised applicant remains responsible for approving and submitting accurate responses.
What evidence will we need?
Evidence depends on the questionnaire. Common examples include configurations, coverage reports, test records, policies, plans and supplier information.
How early should we prepare?
Begin as early as practical. Evidence collection, clarification and remediation can require input from several people and providers.
Is a readiness review the same as an audit?
No. The service is a scoped readiness review unless the proposal explicitly states another form of engagement.
Does Essential Eight alignment guarantee insurance acceptance?
No. The Essential Eight and insurance underwriting have different purposes. Insurers determine their own requirements and decisions.
Sources and review
Use your policy documents and authorised advisers.
The insurer’s current questionnaire, policy wording, schedule and written communications are the definitive sources for the proposed insurance arrangement.
Cybersecurity control reference: Australian Signals Directorate, Essential Eight Maturity Model.
Reviewed by CyberCrunch on 14 August 2026. This guide provides general cybersecurity information. It is not insurance, legal, financial or claims advice and is not independent assurance.
Prepare before the deadline
Review your questionnaire and supporting evidence.
Tell us which insurer questionnaire you received, when it is due and which systems are involved. We will confirm whether the Cyber Insurance Readiness Review fits and provide a defined scope.
Recommended next step
Find the cyber risks to fix first
Book a health check to identify priority gaps and receive a practical improvement roadmap.
Book a cybersecurity health check