What insurers are actually asking in 2026
Cyber insurance in Australia changed materially between 2022 and 2026. What was once a tick-box product is now a structured underwriting exercise. The Australian Small Business and Family Enterprise Ombudsman (ASBFEO) flagged the change in its 2025 cyber resilience guidance, noting that small businesses without basic controls now find cover declined, repriced, or limited to small sub-limits. This guide walks through the actual questions in the 2026 forms used by Chubb, AIG, Coalition, CGU, BizCover-distributed products, and the broker portals — and what evidence the underwriter expects for each "yes".
Audience here is owners and office managers preparing for renewal, not security engineers. You do not need to understand every control to assemble the evidence pack — you just need to know what they want, why they want it, and where to find it.
Question 1 — Multi-factor authentication
The question on the form. "Is multi-factor authentication enforced on email, admin accounts, and remote access?"
Why they ask. Missing MFA is the single most common root cause of business email compromise and ransomware in the Australian Cyber Security Centre's small business case notes. Insurers price aggressively against this risk — and increasingly refuse to write cover without it.
The evidence they want. A screenshot of Microsoft 365 Security Defaults enabled, or a Conditional Access policy with "Require MFA for all users". For Google Workspace, the 2-Step Verification enforcement page. A note of which MFA method is used (authenticator app or hardware key beats SMS).
Plain English answer guide. Most Australian small businesses on Microsoft 365 Business Standard or above enable Security Defaults with one toggle. That single change satisfies the underwriter's question for every Microsoft 365 user. Same effort, same outcome on Google Workspace.
Question 2 — Patching cadence
The question on the form. "Are operating systems and applications updated regularly? What is the maximum delay for applying security updates?"
Why they ask. Unpatched systems are the second most cited cause of ransomware in ACSC small business case notes. ACSC Essential Eight Maturity Level 1 (Australian Cyber Security Centre — Essential Eight Maturity Model, accessed 16 June 2026) sets a thirty-day patching window for security updates and forty-eight hours for extreme-risk vulnerabilities.
The evidence they want. Confirmation that Windows Update is enabled, that Microsoft 365 Apps auto-update, and ideally a monthly patch compliance report from Intune or your managed service provider.
Plain English answer guide. The honest answer for most small businesses is "Windows Update and Microsoft 365 Apps update automatically; servers and routers are updated quarterly." That answer satisfies most underwriters. If your IT provider can produce a monthly Intune patch report, share it — it materially improves pricing.
Question 3 — Endpoint protection
The question on the form. "Is business-grade endpoint protection (EDR) deployed on all devices?"
Why they ask. Free consumer antivirus is not designed for the email-borne threats Australian small businesses face daily. The underwriter wants confidence that ransomware will be detected before it spreads.
The evidence they want. Product name (Microsoft Defender for Business, Sophos, CrowdStrike, SentinelOne, Bitdefender Business), coverage percentage (ideally 100% of devices), and the central console URL.
Plain English answer guide. Microsoft Defender for Business is bundled with Microsoft 365 Business Premium. If you have Business Premium, you already have an underwriter-acceptable EDR — you just need to enrol your devices. Allow about an hour for deployment.
Question 4 — Email security
The question on the form. "Are SPF, DKIM, and DMARC configured on your email domain? What is the DMARC policy?"
Why they ask. Email impersonation underlies most business email compromise incidents. DMARC at p=quarantine or p=reject stops attackers spoofing your domain to your own customers and suppliers.
The evidence they want. DNS record export showing SPF (v=spf1 …), DKIM selectors, and DMARC (v=DMARC1; p=quarantine; …). Increasingly the form asks the policy value (none, quarantine, or reject).
Plain English answer guide. SPF and DKIM are usually already configured by your email provider. DMARC needs explicit setup. Start at p=none for monitoring, move to p=quarantine within thirty days, then p=reject once your reports show clean traffic. Several Australian providers (Cyren, Sendmarc, EasyDMARC) offer free reporting; many brokers include a DMARC check in their pre-bind scan.
Question 5 — Backups
The question on the form. "Are regular backups taken? Are any backup copies kept offline or immutable? When was the last successful restore test?"
Why they ask. Backup is the control that decides whether a ransomware incident is survivable. The "offline or immutable" element is the part insurers most often probe — backups stored in the same cloud account as live data are encrypted by ransomware in the same minute as production.
The evidence they want. Backup product name, retention policy, immutability or offline copy confirmation, and the date of the last successful restore test (must be within twelve months).
Plain English answer guide. Microsoft 365 Backup with immutability satisfies this. So does any reputable SaaS backup with documented immutability (Datto, Veeam, AvePoint). Run a test restore — one mailbox and one file folder — and write down the date. That note is the evidence.
Question 6 — Incident response plan
The question on the form. "Do you have a documented incident response plan? Has it been tested in the last twelve months?"
Why they ask. The OAIC Notifiable Data Breaches scheme (Office of the Australian Information Commissioner — Notifiable Data Breaches scheme, accessed 16 June 2026) imposes a thirty-day assessment clock from the moment a suspected breach is identified. Insurers want to know you can respond inside that window.
The evidence they want. A one-page or short-form incident plan with contact details, decision authority, and the thirty-day NDB trigger. Some underwriters ask for the file directly.
Plain English answer guide. The ACSC publishes a free template at cyber.gov.au. Print, fill in, post on the wall. Annotate with a yearly review date. That is all most underwriters need.
Question 7 — Awareness training
The question on the form. "Do staff receive cyber security awareness training? How often?"
Why they ask. Phishing remains the single most common initial access vector. Underwriters discount the risk where staff are trained.
The evidence they want. Training programme name and last delivery date. Annual training is the typical minimum.
Plain English answer guide. Cyber Wardens (free, ASBFEO and Commonwealth Bank backed, about forty-five minutes per person) is accepted by every Australian cyber insurer reviewed in 2026. Enrol every staff member, retain the completion certificates.
Question 8 — Supplier security expectations
The question on the form. "Do you maintain a list of third-party suppliers with access to your data? Do you require them to notify breaches within a defined timeframe?"
Why they ask. OAIC determinations published in early 2026 confirmed that supplier-caused breaches sit with the contracting business. Underwriters follow the same logic — your supplier risk is your risk.
The evidence they want. A supplier list, ideally with a column for breach-notification commitment.
Plain English answer guide. Most small businesses have five to fifteen suppliers holding their customer or staff personal information. List them on one page, email each a short security expectations note, and confirm annually.
Putting the evidence pack together
The pattern across every 2026 Australian SMB cyber insurance form is the same: evidence beats opinion. A small business that answers "yes" to all eight question themes with confirming screenshots, exports, and a one-page incident plan typically receives:
- Better pricing — often a materially lower premium than the unsupported equivalent.
- Broader cover — ransomware, business email compromise, and supplier-caused breaches all included.
- Faster bind — the broker does not need to come back for more documentation.
A one-week implementation plan that produces this entire pack is described in Cyber security for Australian small business — the practical baseline 2026. The free EDUC4TE Small Business Cyber Security Assessment scores against the same eight question themes in five minutes and produces an insurance-ready evidence list as the result.
Common reasons cover is declined
The 2026 underwriting refusals in the broker portals share three patterns:
- No MFA on email or admin. This is the most common refusal. The fix is thirty minutes in Microsoft 365 admin or Google Workspace admin.
- No offline or immutable backup. Backup-in-the-same-cloud-account fails the underwriter's review. Add Microsoft 365 Backup with immutability or a third-party SaaS backup.
- Unsupported operating systems still in production. Windows 10 reached end-of-support in October 2025 and Windows Server 2012 R2 reached end-of-support in October 2023 — both are now underwriter blockers. Replace or upgrade before renewal.
Insurers will renew cover with declared mitigations if the gap is small and the business has a written remediation plan. The conversation goes better when you bring the plan, not when the underwriter forces it.
Where to go from here
If you want to confirm where you sit before your next renewal, the EDUC4TE Small Business Cyber Security Assessment runs in five minutes and produces the evidence list above. If you want a practitioner to assemble the evidence pack for you and present it to your broker, the practitioner-led assessment service does exactly that. Either way, walking into renewal with the evidence improves pricing and broadens cover.
Sources
- Australian Small Business and Family Enterprise Ombudsman, Cyber security resilience guidance for small business, 2025 refresh. asbfeo.gov.au.
- Australian Cyber Security Centre, Small Business Cyber Security Guide, current edition late 2025. cyber.gov.au.
- Australian Cyber Security Centre, Essential Eight Maturity Model, November 2025 ISM revision. cyber.gov.au.
- Office of the Australian Information Commissioner, Notifiable Data Breaches scheme, current guidance 2026. oaic.gov.au.
- business.gov.au, Cyber security for business, current edition 2026. business.gov.au.
- Cyber Wardens, training programme, accessed May 2026. cyberwardens.com.au.
- Public underwriting questionnaires from Australian cyber insurance carriers, accessed Q1–Q2 2026.
Sources referenced in this article: ACSC Essential Eight Maturity Model; OAIC Notifiable Data Breaches scheme; ASBFEO cyber resilience guidance; ACSC Small Business Cyber Security Guide; business.gov.au; Cyber Wardens; public underwriting questionnaires (Chubb, AIG, Coalition, CGU, BizCover).
