Cyber Insurance for Small Business: What Insurers Now Demand

A few years ago, cyber insurance for a small business was a one-page form. Not any more. Insurers have paid out on too many preventable claims, and their questionnaires now read like a technical audit. If you can't answer their questions honestly, you may find your premium higher — or your claim denied.

What insurers are asking in 2026

Multi-factor authentication (MFA): almost every policy now requires MFA on email and remote access as a baseline. "We're planning to" is not an answer they accept.

Backups: they'll ask how often you back up, where copies are stored, and — the big one — when you last tested a restore. Untested backups are a common reason claims get disputed.

Patching: supported operating systems and prompt security updates. Out-of-support systems like Windows 10 raise immediate flags.

Endpoint protection: managed antivirus or endpoint detection on every device, not just the server.

Staff training: increasingly, insurers ask whether your team gets basic phishing awareness training.

The alignment shortcut

If these questions sound familiar, it's because they're essentially the Essential Eight. Businesses that can demonstrate Essential Eight maturity level one or two answer most insurer questionnaires comfortably — and often negotiate better premiums.

The trap to avoid

The worst outcome isn't a higher premium — it's answering "yes" on the form when the honest answer is "sort of". If a breach investigation later finds MFA wasn't actually enforced, insurers can and do deny claims. Only attest to controls that are genuinely in place and maintained.

Getting insurance-ready: UMI helps Adelaide businesses put these controls in place and documents them, so your next insurance renewal is a formality rather than a guess. Book a free consultation before your renewal date.