Cyber insurance questionnaires: the controls insurers ask about and how to answer them, for SA small businesses and councils

Many South Australian small businesses, not-for-profits and councils hold cyber insurance or are thinking about it, and every new policy or renewal comes with a questionnaire. It asks about multi-factor authentication (MFA), backups, patching, email security, staff training and how you would respond to an incident. The answers can affect whether cover is offered, what it costs, and whether a claim is paid. This guide explains, in plain words, what insurers usually ask, the evidence worth keeping, the mistakes that cause trouble at claim time, and a 30-day plan to get your controls and answers in line. It is general guidance, not insurance, legal or financial advice. Policies differ, so read your own policy wording and talk to your broker or insurer before relying on any detail.

What a cyber policy usually covers

Cover varies a lot between insurers and policies, but most small business cyber policies are built from a similar set of parts. Knowing them helps you read the questionnaire, because each question is really asking how likely you are to need one of these parts.

• Incident response costs: access to an incident hotline, IT forensic specialists, legal advice and public relations support in the first days of an incident.
• Data and system restoration: the cost of recovering or rebuilding systems and data after an attack.
• Business interruption: lost income while systems are down, usually after a waiting period.
• Notification and liability: costs of notifying affected people and regulators, and claims from people whose information was exposed.
• Payment fraud: losses from fake invoices or changed bank details are often limited, optional or excluded. Check this part carefully, because it is one of the most common ways small organisations lose money.

The questions insurers usually ask

Wording differs, but most questionnaires come back to the same controls. They line up closely with the ACSC Essential Eight, which our Essential Eight guide for SA SMEs explains in more depth.

1. MFA: is it on for email, remote access, cloud apps and every administrator account? Many questionnaires ask about each one separately, so "mostly" is not a safe answer. Our password manager and MFA rollout plan covers how to close the gaps.
2. Backups: how often you back up, whether at least one copy is offline or cannot be changed or deleted, whether backups are protected from the same admin accounts as production, and when you last tested a restore.
3. Endpoint protection: whether laptops and servers run endpoint detection and response (EDR) software, and who watches the alerts.
4. Patching: how quickly you install security updates for operating systems, browsers and internet-facing systems, and whether you run anything that no longer receives updates.
5. Email security: filtering for phishing and malicious attachments, and whether your domain has SPF, DKIM and DMARC set up. See our email security guide.
6. Admin access: whether staff use separate admin accounts, how many people hold admin rights, and whether remote access tools are locked down.
7. Payments: whether you confirm new or changed bank details by phoning a known number before paying, and whether payments need a second approver.
8. People and planning: whether staff complete security awareness training, and whether you have a written incident response plan.
9. Data and suppliers: roughly how many personal records you hold, what kind, and which IT providers and software suppliers can reach your systems.

Answer accurately, not optimistically

The questionnaire is usually filled in by a manager or the finance lead, often in a hurry before renewal, and often without the person who actually runs IT. That is where trouble starts. Under Australian insurance law you have obligations to answer questions truthfully and, for business policies, to tell the insurer about matters relevant to the cover. If an answer turns out to be wrong, the insurer may reduce or refuse a claim. Your broker can explain how this applies to your policy.

• Check every yes with your IT provider. "MFA on all remote access" must include the old VPN, the remote desktop tool and the supplier login nobody remembers.
• Say "partly" when that is the truth, and add a note about the plan and date to finish. A short, honest explanation is far better than a yes you cannot prove.
• Keep a copy of the completed questionnaire with your policy, and check it against reality whenever systems change.
• Tell your broker or insurer if a control stops, for example if you move off a backup service, rather than waiting for renewal. Your policy will say what you must report.

Keep the evidence ready

After an incident, the insurer and its specialists will want to see that the controls you described were really in place. Keep a small evidence folder, reviewed each quarter, so you are not trying to reconstruct it in the middle of a crisis.

• A Microsoft 365 or Google Workspace report showing MFA status for every user and administrator.
• Backup job reports and a short record of the last restore test: what was restored, how long it took and who checked it.
• Your EDR console summary showing the devices covered.
• Patch reports, plus a list of any systems that no longer receive updates and the plan to retire them.
• DMARC records and email filtering settings.
• The payment verification procedure and an example approval record.
• Training completion records and the current incident response plan.

Put the insurer in your incident response plan

Many policies expect you to call the insurer’s incident hotline quickly, and some require you to use the insurer’s approved specialists for cover to apply. If the first call goes to someone else, you may pay for work the policy will not cover. Put the policy number, the hotline number and the conditions for notifying the insurer in your cyber incident response plan, and keep a printed copy, because email and shared drives may be unavailable during an incident.

Insurance does not replace legal duties. A data breach may need to be assessed under the Notifiable Data Breaches scheme (see our Privacy Act and notifiable data breaches guide), and businesses above the turnover threshold that make a ransomware payment must report it to the Australian Signals Directorate. Check the current rules when you write your plan.

Councils and not-for-profits

• Councils may arrange cover through a local government scheme or their own risk team rather than buying a cyber policy alone. The same evidence questions still come up, so ask your scheme or risk team what they need and when.
• Not-for-profits often hold sensitive client or donor information with a small IT budget. Funders and peak bodies increasingly ask similar questions, so one evidence folder can serve both.
• Suppliers to government are often asked for proof of insurance in tenders and contracts. Keep the certificate of currency with your capability documents.

A 30-day plan before renewal

1. Week 1: read and compare. Get last year’s questionnaire and the policy wording. Sit down with your IT provider and mark each answer as true, partly true or not true today.
2. Week 2: fix the quick gaps. Turn on MFA where it is missing, separate admin accounts, and set up a phone-back check for bank detail changes.
3. Week 3: test and collect. Run and record a restore test, check EDR coverage and patch status, and build the evidence folder.
4. Week 4: answer and plan. Complete the questionnaire with the accurate answers, add notes for anything in progress with target dates, and put the insurer’s hotline in your incident response plan.

Questions to ask your IT provider

1. Can you confirm, account by account, where MFA is and is not enforced, including administrators and remote access?
2. Is at least one backup copy offline or unchangeable, and when did we last test a full restore?
3. Which devices have EDR, and who responds to its alerts out of hours?
4. How quickly are security updates installed, and which of our systems no longer receive them?
5. Can you produce the evidence folder for us each quarter?
6. Will you help us answer the insurance questionnaire accurately before it goes to the broker?

This article reflects general practice and ACSC guidance as at October 2026. Policies, questionnaires and legal requirements change, so check your policy wording and current guidance, and get advice from your broker before relying on a specific detail.

If the questionnaire asks about staff training or phishing simulations, our security awareness and phishing training guide covers what to run and the records to keep.

Talk to an Adelaide team

If your renewal questionnaire is due and you are not sure the answers are right, talk to us about a cyber insurance readiness review or call 0402 401 584. We can quote a short review that checks each control against the questionnaire, fixes the quick gaps, tests a restore and builds the evidence folder your broker and insurer may ask for. We are not insurance brokers and do not give insurance advice. Learn more about our managed IT and cyber security and training and consultations services.