Cyber insurance renewal checklist 2026: six controls and the proof insurers want
Cyber insurance renewal checklist for 2026: the six controls Australian insurers check, the evidence to have ready, and why to start 90 days before renewal.
Cyber insurers spent the last two years tightening what they'll cover. Heading into renewal season, here's the checklist to work through 90 days early — before your premium is set for you.
We wrote at the start of the year about the controls insurers now demand. Half a year on, the pattern at renewals is consistent: the questionnaire is longer, the attestation is stricter, and the gap between "we have that, roughly" and "we can prove that" is now worth real money — in premium, in excess, and in whether a claim gets paid at all.
What are insurers actually checking in 2026?
Australian cyber insurers renewing policies in 2026 keep checking the same six controls: MFA, endpoint detection and response (EDR), offline or immutable backups, a patching cadence, an incident response plan and Essential Eight evidence. This is the cyber insurance renewal checklist Key IT works through with Melbourne businesses:
MFA everywhere that matters.
Email, remote access, admin accounts, and increasingly the line-of-business systems too. "Mostly" is scored as no.
Endpoint detection and response.
Old-school antivirus no longer ticks the box — insurers want behaviour-based EDR, and many ask who monitors it.
Backups that would survive the attacker.
Offline or immutable copies, separated credentials, and a restore actually tested — with a date you can cite.
Patching with a cadence.
Not "we patch", but how fast for critical vulnerabilities, and what covers the stragglers.
An incident response plan.
Written, current, and ideally exercised — insurers know a practised response cuts their payout dramatically.
Framework evidence.
In Australia that increasingly means Essential Eight alignment, with maturity you can show, not assert.
What evidence do insurers want for each control?
Proof you can hand over on the day, not a confident yes. For each item on the checklist, have this ready:
MFA.
A sign-in or conditional access report showing MFA enforced on every user and admin account, plus how remote access and line-of-business systems require it.
EDR.
The console's device list matched against your asset register so no laptop or server is missing, and the name of whoever responds to its alerts.
Backups.
Where the offline or immutable copy lives, proof the backup admin login is separate from everyday accounts, and a dated restore test result — Key IT runs and documents regular restore tests for its disaster recovery and business continuity clients.
Patching.
Monthly patch compliance reports and recent vulnerability scanning results showing critical issues closed.
Incident response.
The plan's version date, the call list, and notes from the last tabletop exercise. Walking through what happens during a ransomware attack is a good first rehearsal.
Essential Eight.
A dated maturity assessment scored by your weakest control — the way insurers and big clients now judge it.
Can a cyber insurance claim be denied over your renewal answers?
Yes, if a control you declared at renewal turns out not to have been in place. So the most expensive mistake is not a missing control — it is claiming one you cannot prove. Attestations are contract terms: if a claim investigation finds MFA was not actually on the account that got breached, or the "tested" backup was never tested, insurers can and do deny. Answer the questionnaire from evidence, not optimism. If the honest answer is no, fixing the control before renewal beats fudging it every time.
When should you start preparing for a cyber insurance renewal?
At least 90 days before your renewal date, because the fixes take weeks, not days. Rolling MFA across every system, deploying EDR fleet-wide, restructuring backups to immutable copies, running a restore test — each is straightforward with lead time and painful in a deadline week. Start 90 days out and you arrive at renewal with better answers and leverage; start the week the questionnaire lands and you pay this year's premium for last year's posture.
Frequently asked questions
What should a cyber insurance renewal checklist include?
Six controls cover most 2026 questionnaires: MFA on email, remote access and admin accounts; EDR on every device; offline or immutable backups with a dated restore test; a patching cadence for critical vulnerabilities; a current incident response plan; and Essential Eight maturity evidence. For each one, keep the report or record that proves it, not just a yes.
Can our IT provider fill in the insurance questionnaire?
They should at least review it — most denied claims trace back to well-meaning wrong answers. We complete these alongside clients so every yes is backed by something we can produce in a claim.
Will Essential Eight alignment actually lower our premium?
Increasingly, yes — several underwriters price against maturity levels, and some ask for the assessment date. Even where it does not move the premium, it moves insurability and excess.
We got declined last year — what now?
Declines are usually about one or two missing controls, most often MFA gaps or untested backups. Fix those, document them with dates, and reapply through your broker — with enough lead time, the common gaps can usually be closed within a quarter.
Does having a SOC matter to insurers?
Monitored detection and response is one of the strongest answers on the form — it directly shortens the incidents insurers pay for. Key IT's 24/7 SOC monitoring is exactly what that question is asking about.
What if we can't fix a control before the renewal date?
Say so, and show the plan. An honest answer with a remediation date, shared through your broker, is far safer than a yes you cannot back up in a claim. Insurers may still offer cover — sometimes with conditions or a higher excess — while you close the gap.
Do insurers ask about staff security awareness training?
Commonly, yes — many questionnaires ask how often staff are trained and whether you run simulated phishing tests. Dated training records and test results answer it with evidence. Key IT's free phishing simulation demo is a quick way to get a baseline before renewal.
Get renewal-ready
Bring us the questionnaire — or better, beat it. A free cybersecurity health check maps your answers to the six controls above and shows what to fix while there is still time to fix it.
More insights
Cyber insurance in 2026
Cyber insurance requirements for 2026: the six controls insurers expect, from MFA to tested…
Read article →CybersecuritySecurity questionnaires, decoded
Security questionnaire for your small business? The ten questions clients, tenders and cyber…
Read article →RansomwareRansomware reporting now has teeth
Australia's 72-hour ransomware payment reporting rule moved from education to enforcement in 2026…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.