Probably, if your business runs on email, stores customer details or takes payments, and that describes nearly every business today. We are not licensed insurance advisers, so this is not advice about what to buy. It is what to understand before you sit down with a broker, so the conversation is useful and the policy you end up with actually pays out.
What a policy usually covers
Cyber insurance is designed to cover the costs that land on you after an attack, not to stop the attack.
- Incident response, meaning the specialists who work out what happened, contain it and get you running again.
- Data recovery, including rebuilding systems and restoring files.
- Business interruption, meaning lost income while you are down.
- Legal costs, and the cost of notifying customers and the regulator if personal information was exposed.
- Sometimes ransom payments and the cost of negotiating them.
- Sometimes funds transfer fraud, where a scammer tricks you or a customer into paying the wrong bank account.
What is often excluded
Common exclusions include losses from an attack that started before the policy began, incidents caused by systems that were known to be out of date, payments you authorised yourself because a fake invoice looked real, fines that the law does not allow to be insured, and anything where a security control you said you had was not actually in place. That last one matters most.
The application form is your to do list
The form asks the same questions almost every time. Do all staff use two factor sign in for email, where a code on your phone is needed as well as the password? Are backups tested, and is a copy kept offline or somewhere an attacker on your network cannot reach? Are Windows and your other systems kept patched? Do staff get regular training on spotting scam emails? Is there endpoint protection, meaning security software, on every computer?
Treat those questions as a checklist of what to put in place before you apply. First, each yes lowers your premium, and some insurers will not quote at all without them. Second, and more important, insurers check the answers after a claim. If the form said every account had two factor sign in and the account that was broken into did not, the claim can be refused and the policy can be cancelled. A policy bought on optimistic answers is worse than no policy, because you have paid for cover you do not have.
Insurance is not a substitute for the controls
A payout after the event does not bring back the week you lost or the files that were never backed up. The controls on the form are the same ones that stop most attacks in the first place. Put them in, keep evidence that they are in, and the insurance becomes a backstop for the rare case that gets through rather than the whole plan.
What to do next
Before you talk to a broker, get an honest picture of where you stand. An IT security audit checks each of the questions on the form against what is really configured, and gives you a written answer you can hand to the insurer. Most of the controls they ask about line up with the Essential Eight from the ACSC, a set of eight baseline protections for Australian businesses, which we put in place as Essential Eight for Perth businesses. Then take the results to a licensed broker and let them match a policy to your situation.
Does my business insurance already cover cyber incidents?
Often not, or only for a small amount. Ask your broker to show you exactly where it is covered rather than assuming.
Will the insurer check my answers?
Yes, especially after a claim. Keep records showing when each control was put in place so you can prove it.
Is cyber insurance mandatory in Australia?
No. But some larger customers and government contracts require it, and the Privacy Act requires you to report serious data breaches whether you are insured or not.
If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.