Cyber insurance readiness
Cyber insurance renewal coming up? Check what you can prove first.
Before they write or renew a cyber policy, insurers ask about your security controls. Your answers become part of the application, so a “yes” you can’t back up is a problem at claim time. Start with the free readiness check. It scans what anyone can see of your business from the outside.
Free, no signup, your domain only. Open the full tool page, with a copy by email →
Free readiness check · outside view
A clean result here doesn’t mean you’ll pass. Most of the questionnaire is about controls inside your business, which this scan can’t see.
What the free check covers
The free check is honest about its limits. Insurers ask about both halves of this, and only one half can be scanned from a browser.
The free check sees
- Email authentication: SPF, DKIM and DMARC
- Website and SSL certificate security
- Transport encryption for mail to your domain
Only a look inside shows
- MFA on email, remote access and admin accounts
- Backups that are automated, kept off-site and test-restored
- Operating systems and apps patched on a schedule
- Local admin rights limited to the staff who need them
- The Essential Eight basics
What insurers ask
Questionnaires differ between insurers and change from one renewal to the next. The same areas come up again and again: MFA, backups, patching, admin rights and the Essential Eight basics published by the Australian Cyber Security Centre.
If something you declare turns out not to be true, the insurer may be able to reduce or refuse a claim. How that applies to your policy is a question for your broker. My part is making sure your answers match what is actually switched on, with evidence.
Cyber Liability Insurance - Renewal Application
Section 4 of 7 · Security controls declaration
POL-2026-8841
Renewal due 30 days
- No
Is multi-factor authentication (MFA) enforced on all email and remote access?
Assessor: MFA optional for 6 of 14 staff
- Unverified
Are backups automated, kept off-site and test-restored?
Assessor: No restore evidence supplied
- Yes
Are operating systems and applications patched within 14 days?
- No
Are local administrator rights restricted to staff who need them?
- Unverified
Essential Eight maturity level attained (ML1 - ML3)?
Assessor: Not assessed
Underwriter notes
Declared controls could not be evidenced. Cover cannot be bound as declared - remediation and supporting evidence required before renewal.
Cyber Insurance Readiness Review, from $390 + GST.
Pass the insurer's questionnaire - with evidence. Mapped to insurer / Essential Eight requirements.
- 01
Run the free check
From the outside, in your browser. It shows what someone could find about your domain without asking you anything.
- 02
Send me the questionnaire
Your insurer's renewal form, if you have one. If not, I work from the questions insurers commonly ask.
- 03
I check the inside
MFA, backups and the Essential Eight basics in your Microsoft 365 or Google Workspace. Read-only access is enough.
- 04
Gaps and evidence
A report mapped to the questions, the evidence you already have, and what to fix first before you sign.
What you get
- MFA, backups and Essential Eight basics assessed
- One-page report mapped to what insurers ask
- Prioritised gap report + documented evidence for renewal
What I need from you
- Your insurer's questionnaire or renewal form, if you have one
- Admin access to Microsoft 365 or Google Workspace (read-only is fine)
- Half an hour with whoever knows your backups
What I can’t promise
- That an insurer will offer you cover, or at a particular price. That is the insurer's decision.
- Insurance advice. I'm not an insurance broker, so talk to yours about the policy wording.
- That a good report stops every attack. It shows where your controls stand on the day I check.
- Remediation is quoted separately unless included in the written scope
Fixed-price pack
Cyber Insurance Readiness Review
Pass the insurer's questionnaire - with evidence.
Mapped to insurer / Essential Eight requirements
Secure Stripe checkout · full scope →
On a managed plan, most of the answers are already written down.
Every managed client runs The Standard: MFA on every account, managed patching and email authentication at enforcement, with managed devices from Business+. Backups are checked separately, because they are not part of The Standard yet.
Renewal coming up?
Book a free 15-minute chat. Bring the questionnaire and I'll tell you which answers you can already back up.