What do cyber insurers ask, and how do you answer honestly?

Cyber insurance proposal forms ask short yes/no questions that carry a lot of weight. This guide explains what each common question is really asking, what evidence to have ready, and why an inaccurate answer can cost you more than a higher premium.

Why do the questions matter so much?

A proposal form is short, but your answers become the basis of the policy. One global insurer’s short form says the answers "will be incorporated in the policy should one be issued". An Australian broker’s declaration asks you to confirm that "no material facts have been omitted or misrepresented" and to report any change to a material fact before the policy starts.

Forms differ between insurers and change over time, so always read the exact wording in front of you.

What does Australian law say about getting answers wrong?

This section is general information, not legal or insurance advice. Talk to your broker or a lawyer about your own circumstances.

• Duty of disclosure. Section 21 of the Insurance Contracts Act 1984 requires you to disclose, before the contract is entered into, every matter you know of that you know, or a reasonable person in the circumstances could be expected to know, is relevant to the insurer’s decision whether to accept the risk and on what terms. Since 5 October 2021, consumer policies have a different duty, but business policies such as cyber insurance generally remain under the duty of disclosure.
• What the insurer can do. Under section 28, if the insured failed to disclose or made a misrepresentation, and the insurer wouldn’t have entered into the contract for the same premium and on the same terms and conditions, the insurer may reduce its liability on a claim to the amount that puts it in the position it would have been in had the failure not occurred. If the failure was fraudulent, the insurer may avoid the contract altogether.
• Changes before the start date. If you answer "yes" to MFA in March and switch it off for a problem user in April, that matters.

In practice, an honest "no, but here’s our plan" usually leaves you better placed than an optimistic "yes" that a claim later shows was untrue.

The common questions, and how to answer them

The groups below come from publicly available proposal forms (two Australian broker forms and a global insurer’s short form) and Australian broker guidance.

1. Multi-factor authentication

Typical wording: "For which of the following services do you enforce Multi-Factor Authentication (MFA)?", followed by separate yes/no boxes for email, for VPN, remote desktop and other remote access, and for network or cloud administration and other privileged accounts. Another form asks whether MFA is "required for any remote access".

What they’re really asking: whether a stolen password alone can get someone into email, your network or an admin console. "Enforce" means MFA is required, not just available. One insurer’s glossary says a shared secret key, an IP or MAC address, a VPN, a monthly reauthentication procedure and VOIP authentication are not secure second factors.

Evidence to have ready: an MFA registration report from Microsoft 365 (or your email platform) showing every user registered. Your sign-in policy (security defaults or Conditional Access) with screenshots. A list of remote access methods (VPN, remote desktop, remote support tools) and how each enforces MFA. A list of admin accounts and their MFA method.

Risk of answering inaccurately: if one shared mailbox, one service account or a VPN without MFA turns out to be the way in, a "yes" may not hold up.

2. Backups and restore testing

Typical wording: "Does the Insured have a minimum of weekly backups, and recovery procedures for all systems and data that are critical to operating the business?" A longer form asks whether backups are protected by immutable or write-once storage, MFA on backup access, offline or air-gapped copies, or separate privileged accounts not connected to Active Directory.

What they’re really asking: if ransomware encrypts everything an attacker can reach, can you recover without paying? ASD Essentials sets the same expectation: backups protected by "immutable, offline, logically isolated or equivalent controls", repositories isolated from primary systems, and regular restore testing.

Evidence to have ready: a backup scope listing (what’s backed up, how often, where). How backups are protected from deletion. The date and result of the most recent test restore. Your recovery procedure in writing.

Risk of answering inaccurately: "we have backups" and "we can restore critical systems" are different claims. If backups turn out to be on the same network, reachable with the same credentials, or never tested, the answer may be judged inaccurate.

3. Endpoint protection

Typical wording: one form asks whether operating systems are protected by "commercially licensed firewall and antivirus protection". A longer form asks which protections are on all laptops, desktops and servers, from web filtering to endpoint detection and response (EDR).

What they’re really asking: whether every device, including servers, has protection that is centrally managed and monitored, and whether anyone would notice an alert.

Evidence to have ready: a device count from your endpoint protection console and your asset list, showing they match. Which features are on. Who reviews alerts.

Risk of answering inaccurately: "all" means all. One unprotected server or an old laptop outside the console is a gap, and it’s often where attackers land.

4. Patching and unsupported software

Typical wording: broker guidance lists questions such as "How quickly are operating systems and applications patched?" One Australian form also asks whether laptops, desktops and portable media devices are encrypted.

What they’re really asking: whether known vulnerabilities stay open, especially on internet-facing systems, and whether you run software the vendor no longer patches.

Evidence to have ready: a patch compliance report. A list of internet-facing systems (firewall, VPN, remote access, websites) and when they were last updated. A list of any unsupported operating systems or applications, with a replacement plan. For example, Windows Server 2016 leaves Microsoft support on 12 January 2027.

Risk of answering inaccurately: if a claim traces back to an unpatched, internet-facing device you said was kept current, expect questions.

5. Privileged access

Typical wording: MFA questions often single out "privileged user accounts". Broker guidance asks: "Are admin rights limited to those who need them and reviewed?" The backup question above asks whether backup admin accounts are separate from your main directory.

What they’re really asking: how far an attacker gets after compromising one account. If everyone is a local admin and the IT provider uses one shared global admin, the answer is "everywhere".

Evidence to have ready: a list of admin accounts (Microsoft 365, servers, firewall, backup, line-of-business apps), who holds each, and when the list was last reviewed. Confirmation that staff work day to day on standard accounts.

Risk of answering inaccurately: "limited and reviewed" needs a review date. If you can’t produce one, answer accordingly.

6. Email security and payment verification

Typical wording: "Does the Insured have an e-mail filtering system activated for all email accounts?" A longer form lists quarantine, enforced SPF, attachment sandboxing and macros disabled by default. For social engineering or cyber fraud cover, forms ask whether you verify changed payment details "with a known contact by phone or in person" and whether two people authorise larger transfers.

What they’re really asking: whether a fake invoice or a "we’ve changed our bank details" email could result in money leaving the account.

Evidence to have ready: your email filtering settings. SPF, DKIM and DMARC records for each domain. A written payment verification procedure that names the call-back step, and an example of it being followed.

Risk of answering inaccurately: payment verification answers are about process, not technology. If the procedure exists on paper but staff don’t follow it, the answer is not accurate.

7. Staff training

Typical wording: "Does the Insured educate themselves and provide training materials to their employees (if applicable) on the dangers of cyber risks including cyber fraud and phishing?"

What they’re really asking: whether staff would recognise and report a phishing email or a payment redirection request.

Evidence to have ready: training records with dates and completion rates, and phishing simulation results if you run them.

Risk of answering inaccurately: "yes" based on one session years ago, with half the current staff never trained, is hard to defend.

8. Incident response plan

Typical wording: broker guidance asks: "Is there a written, tested plan with key contacts?"

What they’re really asking: when something goes wrong, does someone know who to call, what to switch off, how to preserve evidence and how to notify the insurer? Check your policy wording for how and when the insurer must be told.

Evidence to have ready: a written plan with roles, contacts (including your insurer’s incident line), decision points and notification steps. The date it was last tested, for example in a tabletop exercise. ASD’s executive guidance asks whether you have "an up-to-date and regularly tested cyber security incident response plan".

Risk of answering inaccurately: "we’d call our IT provider" isn’t a plan. If a plan doesn’t exist, say so.

9. Third parties and vendor management

Typical wording: forms ask whether past incidents included errors by "an employee of any third-party service provider", whether you provide hosting or IT services to others, and, for subsidiaries, about network connections to a parent organisation.

What they’re really asking: who else can reach your systems and data, and whether a problem at a supplier becomes your claim. ASD’s executive guidance asks a related question: "Do our agreements with service providers include cyber security incident reporting and response activities?"

Evidence to have ready: a list of suppliers with access to your systems or data, what access each has, and whether contracts cover security and incident notification.

Risk of answering inaccurately: if you said no third parties had access, and one did, that’s a disclosure problem.

10. Past incidents and known circumstances

Typical wording: "During the past three years, did your business experience a cyber incident, claim or loss, whether insured or not…" and "Are you aware of any circumstance that could give rise to a claim under this insurance policy?"

What they’re really asking: anything that happened, including incidents you handled yourself, and anything you know of that could become a claim.

Evidence to have ready: a short incident log with dates, what happened, what it cost and what you changed.

Risk of answering inaccurately: this is the question where non-disclosure is most clear-cut. A known suspicious event that isn’t disclosed, then becomes a claim, is exactly what the duty of disclosure covers.

Cyber insurance readiness checklist

Score one point for each item you can answer "yes" and support with evidence today.

Identity and access

1. MFA is enforced for every email account, including shared mailboxes that allow sign-in.
2. MFA is enforced for all remote access (VPN, remote desktop, remote support tools).
3. MFA is enforced for every admin account, using a method tied to the business, not a personal phone.
4. Admin rights are limited to people who need them, staff work on standard accounts, and the admin list was reviewed recently.

Backups and recovery

1. Critical systems and data are backed up on a defined schedule.
2. At least one backup copy is immutable, offline or isolated from your main network and credentials.
3. A restore has been tested, with the date and result recorded.

Devices and patching

1. Every laptop, desktop and server has centrally managed endpoint protection, and the count matches your asset list.
2. Operating systems and applications are patched on a defined schedule, with a compliance report.
3. Internet-facing devices (firewall, VPN, remote access) are up to date.
4. You have no unsupported operating systems or applications, or each one has a written replacement plan.
5. Laptops are encrypted.

Email and payments

1. Email filtering is on for all mailboxes, and SPF, DKIM and DMARC are set for your domains.
2. Changes to supplier bank details are verified by calling a known number, and staff follow the procedure.
3. Payments above a set threshold need a second person to approve.

People and plans

1. Staff have completed security awareness training, with dated records.
2. You have a written incident response plan with contacts, including your insurer’s incident line.
3. The plan has been tested or walked through, with a date.

Third parties and history

1. You have a list of suppliers with access to your systems or data, and what access each has.
2. You have a written record of any incidents, attempted extortion or privacy complaints in the past three to five years.

Your score

• 17 to 20: you’re in good shape. Assemble the evidence pack and answer the form item by item.
• 12 to 16: answer honestly, note the gaps, and include a dated plan to close them. Your broker can tell you how the insurer is likely to view each one.
• Under 12: talk to your broker before you submit. Closing the biggest gaps first (MFA, backups, endpoint protection) may change the terms available.

How to fill in the form

1. Get the insurer’s current form early from your broker, not the week before renewal.
2. Have whoever manages your IT check every technical answer, and keep their notes.
3. Use the comments field for exceptions. "MFA enforced for all users except one service mailbox that can’t sign in interactively; replacement scheduled for March" beats a bare "yes".
4. Keep the evidence pack with the date you submitted, and report material changes before the start date.

To close the gaps, our managed security service covers MFA, endpoint protection, patching and monitoring. ASD Essentials, the evolution of the Essential Eight, is a sensible structure for the work; see our ASD Essentials page.

Key takeaways

• Proposal forms ask about the same core controls. Read each word: "enforce", "all" and "tested" each have specific meanings.
• Build an evidence pack before you answer: MFA reports, backup scope and a dated restore test, endpoint counts, patch reports, admin lists, training records and your incident plan.
• For business policies, the duty of disclosure applies. An inaccurate answer can reduce a claim payment, and a fraudulent one can void the policy (general information, not legal advice).
• An honest "no, with a plan" is safer than an optimistic "yes".
• Use the 20-point checklist to find gaps early, and close the biggest ones (MFA, backups, endpoint protection) first.

Sources

• Insurance Contracts Act 1984 (Cth), Federal Register of Legislation (sections 21 and 28)
• Cyber Insurance Proposal Form, insurance.com.au (February 2025)
• Cyber questions form, BizCover for Brokers
• Cyber Enterprise Risk Management short proposal form, Chubb New Zealand (question wording; New Zealand law differs)
• Cyber insurance requirements in Australia, upcover (October 2026)
• Cyber security incident response planning: Executive guidance, ASD (December 2024)
• ASD Essentials transition guide (backups, MFA), cyber.gov.au (15 October 2026)
• Windows Server 2016 lifecycle, Microsoft Learn