Cyber insurance is getting harder to obtain — and easier to have a claim denied. Here is what insurers now expect.
A few years ago, cyber insurance was easy to buy and asked few questions. That era is over. After heavy losses, insurers have tightened sharply: they now require evidence of specific security controls before they will offer cover, and they will deny a claim if you did not actually have the controls you said you did.
What are the cyber insurance requirements in 2026?
Cyber insurance requirements in 2026 centre on six controls: multi-factor authentication (MFA), endpoint detection and response (EDR), tested backups, patching, security awareness training, and email filtering with access controls. Insurers now want evidence that each one is actually in place, not just a tick on the form. Questionnaires vary between insurers, but these are the controls Key IT checks Melbourne businesses against:
Multi-factor authentication
On email, remote access and admin accounts. This is non-negotiable for most insurers now.
Endpoint detection and response (EDR)
Modern protection on every device, not just basic antivirus.
Tested, secure backups
Ideally immutable, so ransomware cannot destroy them, and proven to restore.
Patching
Operating systems and software kept up to date.
Security awareness training
Staff trained to recognise phishing.
Email filtering and access controls
To reduce the most common entry points.
These map closely to the Essential Eight — which is no coincidence. Insurers increasingly ask businesses to prove their Essential Eight maturity rather than simply declare it.
The framework itself is changing. The Australian Signals Directorate released ASD Essentials on 15 October 2026 to succeed the Essential Eight, which stays on cyber.gov.au through a transition expected to take a year or two. Insurers, tenders and clients still ask for Essential Eight evidence for now, so the six controls above are still the ones to prove at renewal. Our explainer on what ASD Essentials means for your business covers what changes and what stays the same.
Why do cyber insurance claims get denied?
Claims get denied when a control you declared turns out to be missing at the time of the breach. Picture it: the application asks "do you have MFA on all remote access?" and someone ticks yes to get the policy. Then a breach happens through an account without MFA — and the insurer, on investigation, denies the claim because the control was not actually in place. The questionnaire is not paperwork; it is the contract. Answering it accurately, and actually having the controls, is what makes your policy worth having.
What evidence should you have ready for your insurer?
Keep proof you could hand an insurer or claims assessor tomorrow, control by control:
MFA
A report showing every user, admin and remote-access account is enrolled, with no forgotten exceptions.
EDR
A report from your EDR console showing every device has the agent installed and reporting, plus who responds to its alerts.
Backups
The date of your last successful test restore, confirmation that at least one copy is immutable or offline, and a written disaster recovery plan.
Patching
Patch compliance reports and recent vulnerability scan results showing nothing critical left open.
Training
Completion records and the results of phishing simulation tests.
Email and access
Your mail filtering settings and a current list of who holds admin access.
If you cannot produce the evidence for a control, treat it as not yet in place and fix it before you sign.
Is cyber insurance enough on its own?
No. A policy helps pay for the damage after an incident, but it cannot stop the incident or win back lost days and clients, which are a big part of what a cyber attack really costs a small Australian business. The same controls that satisfy insurers also genuinely lower your risk and can reduce your premiums, so getting your security in order is about not needing to claim in the first place. Strong security and good insurance reinforce each other.
How does Key IT help Melbourne businesses meet insurer requirements?
We align your environment to the controls insurers ask about, complete or help you complete the security questionnaire accurately, and provide documentation proving the controls are in place — through our managed cybersecurity service, backed by Key IT's 24/7 SOC monitoring. So your cover is valid and your risk is genuinely lower. Renewal coming up? Work through our cyber insurance renewal checklist 90 days out.
And if the worst does happen, a practised incident response process makes both the recovery and the claim itself far less painful.
Frequently asked questions
What controls do cyber insurers require?
Commonly MFA, endpoint detection and response, tested and secure backups, patching, security awareness training, and email/access controls.
Can a cyber insurance claim be denied?
Yes — if the controls you declared on the application were not actually in place when the breach occurred. Accuracy on the questionnaire is essential.
Does good security lower my premiums?
Often, yes. The controls insurers require also reduce your risk, which can lower premiums and, more importantly, the chance of needing to claim.
Do these requirements match the Essential Eight?
Closely. Insurer requirements map well to the Essential Eight, so working to that baseline positions you well for cover.
Will ASD Essentials change what my insurer asks for?
Not yet. ASD Essentials succeeds the Essential Eight, but insurers still ask for Essential Eight evidence for now, and because each insurer writes its own questionnaire, any change will arrive insurer by insurer. Your existing Essential Eight work still counts, though ASD advises checking your controls against the new framework rather than assuming they are equivalent. Keep dated evidence for each control so you can answer either way.
Is MFA required for cyber insurance?
For most insurers, yes. MFA on email, remote access and admin accounts is usually a minimum condition of cover, and the question is increasingly whether it covers every account, not most. One account left without MFA is exactly the gap a claims investigation looks for.
Are cyber insurance questionnaires the same for every insurer?
No. Wording and depth vary between insurers and brokers, but the core questions on MFA, EDR, backups, patching, training and email security are consistent. Answer from evidence, and ask your broker about anything you are unsure of rather than guessing.
Can I get cyber insurance without all of these controls?
Sometimes, but expect a higher premium, a larger excess, exclusions or a decline. Be honest on the application, then close the gaps, starting with MFA and tested backups. A free IT & Cyber Security Review from Key IT shows which gaps you have.
How exposed is your business? A free cybersecurity health check gives you an Essential Eight snapshot and your top three risks.
Request the Free Check