Cyber insurance renewal: six questions Australian businesses should ask
Updated: Oct 13
Cyber risk is an operational issue for Australian businesses, not just a technology issue. A professional firm, distributor, contractor or growing company relies on email, cloud systems, customer records, online banking, payment platforms and third-party suppliers every day.
An incident can interrupt trading, expose client information, disrupt payments and create decisions that need to be made quickly — about recovery, about who to tell, and in some cases about legal reporting obligations.
Cyber insurance can provide access to specialist response support and may respond to certain costs and liabilities arising from an insured event. What it responds to depends on the policy, and the policy needs to be considered against how the business actually operates.
Renewal is the practical point to test that.
1. What has changed in the business since the last cyber insurance renewal?
Cyber exposure moves with the business. Since the last renewal, there may be more staff, a larger customer database, a move to cloud-based systems, new payment processes, remote or hybrid working, or greater reliance on external technology providers.
A business that has grown or changed materially should not assume the information given at last renewal — or the structure of the policy bought on the back of it — still fits.
2. What would cause the most disruption if you lost it?
For some businesses, loss of email access is immediately disabling. For others the concern is customer records, financial systems, an online sales platform, operational technology, or access to supplier portals.
It is also worth being specific about what information the business holds, processes or can access: personal information, confidential client information, payment details, and commercial records.
That second list matters for the next question.
3. Do you hold personal information — and do the NDB obligations apply
Australia's Notifiable Data Breaches scheme sits in Part IIIC of the Privacy Act 1988 and is administered by the Office of the Australian Information Commissioner. It applies to organisations covered by the Privacy Act that have obligations to protect the personal information they hold.
Businesses with an annual turnover above $3 million are generally covered. Turnover is not the whole answer, though: private-sector health service providers, credit reporting bodies and credit providers are covered irrespective of size, and certain other smaller operators have obligations in relation to particular kinds of information.
An eligible data breach involves unauthorised access to, unauthorised disclosure of, or loss of personal information; a likelihood of serious harm to one or more individuals; and an inability to prevent that risk of serious harm through remedial action.
Two timeframes are commonly confused, and the distinction is worth understanding before an incident rather than during one:
Where a business suspects an eligible data breach, it must take all reasonable steps to complete an assessment within 30 calendar days of becoming aware of the grounds for suspicion.
Once there are reasonable grounds to believe an eligible data breach has occurred, the business must notify affected individuals and the OAIC as soon as practicable. That is a separate obligation, and it is not a 30-day window.
Businesses that are covered should know in advance who makes the assessment call, and on what information.
4. Cyber fraud, payment instructions and third-party funds
This is an area where the scope of cyber cover needs particular attention.
A policy that responds to a network intrusion will not necessarily respond where money leaves the business after someone acts on a fraudulent payment instruction. Social engineering fraud, funds-transfer fraud, compromised supplier bank details and misdirected payments may sit under separate insuring clauses, carry separate sub-limits, or be excluded altogether. They can also depend on the business having followed specified verification procedures.
The related exposures are worth testing expressly rather than assuming:
Funds transferred by the business on fraudulent instructions
Funds belonging to clients or third parties held or handled by the business
Compromise of customer payment credentials
Loss suffered by a third party as a result of an incident in the business's systems
Contractual obligations to customers relating to data or security
Businesses that handle client money, process payments, or hold customer account access should treat these as specific questions for the renewal discussion, not general ones.
5. Does the policy scope match the exposure?
Cyber wordings differ materially between insurers. Depending on the policy and the circumstances, cover may extend to incident response services, forensic investigation, business interruption, legal defence costs, privacy-related liabilities or cyber extortion.
The parts that determine whether it is useful are the parts that are easiest to skip: the limit and the sub-limits under it, the retention, the exclusions, the notification requirements, the waiting period on business interruption, and whether the insurer requires its own panel of response providers.
It is also worth understanding whether the policy includes security-control conditions, representations or other requirements that the business may no longer meet in practice.
6. Is there a response plan — and do you know your reporting obligations?
In the early hours of an incident, decisions get made quickly. Staff should know who to contact, how systems can be isolated, what records may be needed, and when insurers, legal advisers, IT specialists, customers or regulators may need to be involved.
Reporting obligations may extend beyond privacy. Under Part 3 of the Cyber Security Act 2024, which commenced on 30 May 2025, a reporting business entity that makes a ransomware or cyber extortion payment — or becomes aware one has been made on its behalf — must report the payment to the Australian Signals Directorate within 72 hours.
A reporting business entity is one carrying on business in Australia with an annual turnover of $3 million or more in the previous financial year, or a responsible entity for a critical infrastructure asset under Part 2B of the Security of Critical Infrastructure Act 2018.
Two points are commonly misread. The obligation is triggered by making a payment, not by receiving a demand. And it applies whether the payment is made by the business itself or by an adviser acting on its behalf.
This reporting obligation is separate from any notification obligations that may arise under the Privacy Act, under contract, or under an insurer's policy notification requirements. More than one clock can be running at the same time.
A plan does not need to be elaborate. It needs to be current, and it needs to reflect the size and nature of the business.
Controls still matter
Insurance is not a substitute for practical security. The Australian Signals Directorate's Small Business Cyber Security Guide sets out measures including turning on multi-factor authentication, keeping software updated, backing up information, and limiting access to sensitive systems.
The point is not a perfect security environment. It is reducing avoidable exposure, and being able to respond effectively when something does happen.
A useful renewal conversation
Before renewal, it helps to discuss:
Changes to systems, data, staff, operations and revenue since last renewal
Whether the business holds client, customer or payment information, and whether the NDB obligations apply
Dependencies on software providers, cloud platforms and outsourced IT support
Business interruption exposure if systems or email were unavailable
How the policy treats fraudulent payment instructions and third-party funds
Limits, sub-limits, retentions, exclusions and notification requirements
What the business would actually do in the first 24 hours of an incident
Talk to Virtus about your cover
If your business is approaching cyber renewal, has changed the way it uses technology, or is responding to customer and supplier security requirements, Virtus can help you work through the commercial insurance issues relevant to your circumstances. This article provides general information only and is not legal, cyber-security or personal advice. It does not take into account your objectives, financial situation or needs. Businesses should obtain appropriate legal, technology and insurance advice for their circumstances. Any insurance cover is subject to the terms, conditions, limits and exclusions of the relevant policy.