Failures, incidents and official sources
Cyber insurance and managed security: what policies cover, proposal forms and panel rules
A plain guide to cyber insurance for Australian SMBs: typical covers and exclusions, how managed security answers proposal-form questions, panel firms, excesses and disputes.
Cyber insurance and managed security do different jobs: managed security tries to prevent and contain an incident; cyber insurance helps pay for the consequences, such as incident response, data restoration, business interruption and liability to others, subject to limits, sub-limits, excesses and exclusions. They interact closely. Insurers' proposal forms ask about controls such as MFA, backups, endpoint detection and patching, and many policies require you to use the insurer's panel of response firms or get consent before spending. The practical rule: tell your broker or insurer what your managed service actually does, make sure the answers on your proposal form are true, and align your incident plan with the policy's notification and panel conditions. Policy wordings differ widely, so everything here is general.
This guide belongs to the failures pillar. It is general information, not insurance advice; a licensed broker or adviser can explain a specific policy.
What cyber policies commonly cover
| Cover area | Typical examples | Common limits and conditions |
|---|---|---|
| Incident response costs | Forensic investigation, legal advice, breach coaching, notification costs | Often must use panel firms or get consent |
| Data and system restoration | Restoring data and software after an attack | May exclude upgrading or betterment |
| Business interruption | Lost profit and extra costs while systems are down | Waiting period (hours) before cover starts; proof of loss needed |
| Cyber extortion | Costs of responding to extortion, and in some policies payments where lawful | Sub-limits; insurer consent; sanctions and reporting duties still apply |
| Privacy and network liability | Claims by customers or others after a breach | Defence costs and damages up to the limit |
| Regulatory | Costs of responding to a regulator's investigation | Penalties themselves may not be insurable; check wording |
| Social engineering / funds transfer fraud | Payment redirection losses | Often a low sub-limit or separate endorsement |
Exclusions often include prior known incidents, failure to maintain stated security controls (in some wordings), war and state-backed attacks (with varying definitions), infrastructure outages, and betterment.
Proposal forms: where managed security meets insurance
Insurers typically ask about controls like these. Your managed service provider can help you answer accurately:
| Proposal question (typical) | Evidence your provider can give |
|---|---|
| Is MFA enforced for email, remote access and privileged accounts? | Identity configuration report |
| Do you use EDR on all endpoints and servers? | Monitored device list compared with your asset list |
| Is there 24/7 monitoring? | Contract wording on overnight triage and containment |
| How often are critical patches applied? | Patch compliance report |
| Are backups offline or immutable, and tested? | Backup configuration and last restore test |
| Do you have an incident response plan? | Plan document and tabletop exercise record |
| What Essential Eight maturity have you reached? | Assessment report and the model version used |
An inaccurate answer can cause problems at claim time. For business insurance (contracts that are not consumer insurance contracts), the insured has a duty of disclosure before entering the contract under section 21 of the Insurance Contracts Act 1984; consumer insurance instead carries a duty to take reasonable care not to make a misrepresentation (section 20B). Ask your broker how it applies to you. If a control is only partly in place (for example MFA on email but not on the remote desktop gateway), say so.
Panels, consent and your IR retainer
Many policies give access to an incident hotline and a panel of responders and lawyers. Conditions vary:
- some require you to use the panel for costs to be covered;
- some allow your own firm with prior written consent;
- most require prompt notification, sometimes within a short window.
If you have an IR retainer with a firm that is not on the panel, ask the insurer before an incident whether it will approve that firm. Write the answer into your incident plan. Duplicate arrangements, where a business pays a retainer the insurer will not reimburse, are a common and avoidable waste.
Illustrative policy arithmetic
The figures below are illustrative, to show how limits and excesses interact, not typical policy terms.
| Item | Amount |
|---|---|
| Policy limit (aggregate) | $1,000,000 |
| Excess per claim | $10,000 |
| Business interruption waiting period | 12 hours |
| Social engineering fraud sub-limit | $50,000 |
A business loses $80,000 to a payment redirection fraud. If the policy covers social engineering fraud under the sub-limit, the most it pays is $50,000 less the $10,000 excess = $40,000, leaving the business $40,000 out of pocket (assuming the excess applies to this cover, which depends on the wording). Process controls such as call-back verification are worth more than the sub-limit here.
Insurance and the law
- Insurance does not change your obligations under the Privacy Act or the Cyber Security Act 2024. If an insurer or its negotiator pays a ransom on your behalf, the 72-hour reporting obligation still applies to a reporting business entity.
- Whether penalties can be insured is a legal question; many wordings exclude them.
- If you have a dispute with an insurer, use its internal complaints process first. Small businesses can then generally go to the Australian Financial Complaints Authority (AFCA), subject to its eligibility rules.
Frequently asked questions
Will managed security lower my premium?
It may help your risk profile and the insurer's willingness to offer cover. Premiums depend on many factors; ask your broker how specific controls are treated.
Do I need cyber insurance if I have MDR?
They cover different risks. MDR reduces the chance and size of an incident; insurance funds recovery and liability. Many businesses have both.
Does business insurance already include cyber?
Some packages include limited cyber cover; many exclude it. Check the wording or ask your broker.
What should I do first in an incident: call the insurer or my provider?
Follow your incident plan. Usually contain first with your provider, then notify the insurer promptly, within any policy deadline. See the first 72 hours.
Sources
- Australian Financial Complaints Authority — insurance complaints for individuals and small businesses
- Australian Securities and Investments Commission — insurance and financial services regulation
- Moneysmart — general information about insurance
- ASD's Australian Cyber Security Centre — controls insurers commonly ask about, including the Essential Eight
