Australian Companies Checklist for Cyber Insurance
In today’s digital-first environment, cyber threats are a growing concern, especially for Australian businesses. As our reliance on online systems and data continues to increase, obtaining comprehensive cyber insurance isn’t just a safety net, it’s a pivotal component of any risk management strategy.
This post demystifies the complexities surrounding cyber insurance and provides a detailed checklist for Australian companies looking to safeguard their digital assets.
Understanding Cyber Insurance
Cyber insurance is a specialised product designed to offer protection against a multitude of electronic perils, including data breaches, cyber theft, and other IT infrastructure-related risks. It supports businesses in mitigating the financial repercussions of cyber incidents.
Assessing Your Risk Profile
Before seeking out an insurance policy, it’s essential to evaluate your company’s risk exposure:
- Conduct a thorough audit of your IT environment.
- Identify sensitive data and map the flow of that information within your organisation.
- Recognise potential internal and external cybersecurity threats.
- Review historical security incidents for patterns or recurring vulnerabilities.
Choosing the Right Cyber Insurance Policy
When hunting for the ideal cyber insurance policy, focus on the following aspects:
- Insurer’s reputation and experience in cybersecurity coverage.
- The scope of the insurance provider’s policies.
- Response times and support services offered in the event of a breach.
Coverage and Limits
Cyber insurance policies vary broadly in terms of coverage. Ensure your organisation’s significant risks are covered and establish appropriate insurance limits based on:
- The nature and scope of your business operations.
- The size and sensitivity of the customer data you maintain.
- The financial resources your company could allocate in response to a cyber incident.
Policy Exclusions
Be vigilant about what is not covered in your policy. Common exclusions may include:
- Intellectual property theft.
- Costs associated with improving the existing IT infrastructure after a cyber event.
- Certain types of targeted attacks or acts by nation-states.
Claims Process
Familiarise yourself with the insurer’s claim process:
- Understand the timeframe within which an incident must be reported.
- Pre-identify the documentation required for filing a claim.
- Learn about the insurer’s policy for handling claims including any support for incident response.
Cybersecurity Measures and Compliance
Implementing robust cybersecurity measures can not only reduce your risk profile but also potentially lower insurance premiums. Consider the following:
- Regular security training for employees.
- Routine audits and assessments of security protocols.
- Incident response plans to react swiftly to cyber threats.
Industry Regulations and Compliance
Australia has specific cybersecurity regulations, and compliance can impact your insurance terms. Keep abreast of:
- The Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme.
- Industry-specific guidelines like those affecting finance, healthcare, and education sectors.
- Standards set out by the Office of the Australian Information Commissioner (OAIC).
Conclusion
Cyber insurance is essential in our increasingly interconnected world. Australian businesses, especially, should not overlook its importance as part of a broader risk management plan. By following the checklist above, companies can not only choose the best policy for their needs but also enhance their overall cybersecurity posture.
Remember that insurance is only one element of cybersecurity. Continuous improvements in IT security practices and protocols are indispensable in safeguarding against evolving cyber threats.
With this comprehensive cyber insurance checklist, Australian businesses should feel empowered to navigate the complexities of cybersecurity risks and coverage with confidence.
The questions to ask before you sign
Cyber policies vary far more than public liability or professional indemnity, and the differences live in the definitions rather than the headline limit. Five questions separate a policy that will respond from one that will argue.
1. Is the limit shared or per event? A single aggregate limit across incident response, business interruption, extortion and third-party liability behaves very differently from separate sub-limits. Ask which costs erode the limit.
2. How is business interruption measured, and what is the waiting period? Many policies do not begin paying until a system has been down for a set number of hours. If your waiting period is twelve hours and your realistic outage is eight, the cover is decorative.
3. Who runs the incident? Most insurers require you to use their panel for forensics, legal and communications. That can be a benefit, since the panel is experienced, but it also means your existing provider may not be authorised to act. Find out before an incident, not during one.
4. What does the policy say about dependent business interruption? If your revenue stops because your supplier’s systems went down rather than yours, that is a different clause, and it is often excluded or heavily sub-limited.
5. What is excluded? Look specifically for exclusions covering unpatched known vulnerabilities, unsupported operating systems, war and state-sponsored activity, and failure to maintain the controls you declared on the application.
The controls that change your premium
Underwriters price on a fairly consistent set of controls, and the same items appear on almost every Australian application:
- Multi-factor authentication on email, remote access and privileged accounts
- Tested backups with an offline or immutable copy
- Endpoint detection and response with someone actually monitoring it
- Timely patching of internet-facing systems
- Controlled and reviewed administrative privileges
- Security awareness training with phishing simulation
- A documented and exercised incident response plan
That list overlaps almost entirely with the Essential Eight, which is the useful insight for budgeting. Work done to reach Essential Eight Maturity Level 1 or 2 is also the work that moves an insurance application from declined to quoted, and often from quoted to affordable. Treat them as one programme rather than two.
Whatever you declare on the application, keep the evidence. If you claim, the first thing the insurer reviews is whether the controls you described were in place at the time of the loss.
Siege Cyber prepares Australian businesses for cyber insurance applications and renewals, so the answers on the form match the controls actually in place. Get a Fixed-Price Quote.