Cyber Insurance Requirements in Australia: What Insurers Actually Check

Why professional services firms are exposed

Accountants, lawyers and other advisers hold concentrated collections of tax file numbers, bank details, identity documents and confidential client records. Trusted email relationships also give attackers a route to convincing payment requests. Collecting only what you need and securely disposing of records when lawful reduces the information a breach can expose.

The OAIC received 1,205 data breach notifications in 2025, up 8% on 2024 and the highest annual total since mandatory reporting began. Malicious or criminal activity accounted for 716 notifications. These are reported breaches, not a count of every cyber incident in Australia. See the OAIC’s 2025 statistics.

Does the Privacy Act apply to your business?

Businesses with annual turnover above $3 million are generally covered. Some smaller businesses are covered too, including private health service providers and businesses that trade in personal information. Specific obligations can also apply to tax file number information and credit reporting. Check the OAIC’s small business guidance rather than assuming turnover alone settles the question.

From 1 July 2026, lawyers, accountants, conveyancers and other businesses providing designated services become subject to the expanded AML/CTF regime. For small firms brought into the Privacy Act through that regime, coverage relates to their AML/CTF activities; it does not automatically extend to unrelated business activities unless another basis for coverage applies. See the OAIC’s guidance for reporting entities. Do not confuse these changes with proposals to remove the broader small business exemption.

Privacy failures have real consequences. In October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million over the Medlab breach, including failures to protect information, assess the breach promptly and notify it on time. Read the OAIC’s enforcement announcement.

Maximum corporate penalties for serious privacy interference can reach the greater of $50 million or three times the attributable benefit; where that benefit cannot be determined, the turnover-based alternative is 30% of adjusted turnover during the breach turnover period. Lower-tier penalties also exist under the Privacy Act’s civil penalty provisions. Separately, the statutory tort for serious invasions of privacy commenced on 10 June 2025 and can apply beyond businesses covered by the Australian Privacy Principles. It has its own legal tests; a breach does not automatically establish liability.

Breach notification: assess promptly, notify when required

Under the Notifiable Data Breaches scheme, an eligible breach involves unauthorised access, disclosure or loss of personal information likely to cause serious harm, where remedial action has not prevented that risk. Follow the OAIC’s response guidance:

1. Contain and assess. Investigate promptly and take all reasonable steps to complete the assessment within 30 calendar days after becoming aware of grounds to suspect an eligible breach. This is not a waiting period.
2. Determine likely serious harm. Consider the information, who accessed it, the protections in place and whether effective remediation prevents the risk. Record the reasoning.
3. Notify when the threshold is met. Notify the OAIC and individuals at risk as soon as practicable, unless an exception applies. Do not wait until day 30 if an eligible breach is already established.

What a cyber policy may cover

First-party cover addresses your own costs: incident response, forensics, legal advice, notification and client support, data restoration, business interruption and potentially cyber extortion response where lawful. Third-party cover addresses claims against you, such as privacy liability, regulatory defence and certain media or network liabilities.

These are coverage categories to discuss with your broker, not a promise that every policy includes them. Limits, excesses, exclusions and consent requirements apply. Fines, penalties and ransom payments are not necessarily lawful to insure or pay, and coverage for privacy claims needs to be checked against the actual wording.

Phishing, invoice fraud and CEO impersonation

Phishing can provide the access an attacker needs to read email or steal files. Invoice fraud then exploits that trust: an attacker substitutes bank details in a genuine payment conversation. CEO impersonation uses authority and urgency, sometimes through a cloned voice or video, to pressure staff into transferring money.

A policy may cover investigating a compromised mailbox while limiting or excluding the payment that followed. Ask specifically about social engineering, fraudulent funds transfers, supplier impersonation and whether separate crime cover is needed. The headline cyber limit may be very different from the amount available for a tricked payment.

A practical payment rule: verify new or changed bank details by calling a known, independently sourced number. Apply the rule even when the request appears to come from a partner or director, and never use the contact number supplied in the suspicious request.

What insurers ask about: controls and evidence

Requirements vary by insurer, business and policy. Prepare to explain the scope of each control, any exceptions and how you keep it operating.

• Enforced MFA: email, remote access and privileged accounts. Keep enforcement reports and document exceptions; making MFA available is different from requiring it.
• Password and access management: unique passwords, a business password manager, restricted administrator access and prompt removal of departed users.
• EDR/XDR and monitoring: endpoint detection and response, or extended detection and response, with defined alert ownership and after-hours coverage. Retain device coverage reports and evidence of response activity.
• Firewalls and patching: maintained configurations, an asset inventory, risk-based patch deadlines and reports showing overdue vulnerabilities.
• Isolated, tested backups: offline or immutable copies protected from compromised production credentials. Keep dated restore tests showing what was recovered and how long it took.
• People and email protection: mail filtering, security awareness training, phishing exercises and a clear way for staff to report suspicious activity.
• An exercised response plan: named decision-makers, current contacts and a dated tabletop exercise with follow-up actions.

Six policy details to review before renewal

1. Accurate proposal answers. Verify answers against the actual environment. Misrepresentation or non-disclosure can affect cover, subject to the policy and applicable law. Ask your broker how to disclose gaps and subsequent changes.
2. Ongoing control conditions. Check whether cover depends on specified controls operating at the time of an incident. Track exceptions and lapses throughout the policy period.
3. Social engineering sub-limits. Confirm the amount available for invoice fraud and tricked payments, the excess and any verification conditions.
4. Approved response providers. Know the insurer hotline and whether consent is required before appointing lawyers, forensic specialists or other responders. Unapproved costs may not be reimbursed.
5. Business interruption and betterment. Check the waiting period, indemnity period, loss calculation and treatment of supplier outages. Restoration cover may not fund upgrades to your previous systems.
6. War and infrastructure exclusions. Ask how the wording treats state-linked attacks and outages of internet, telecommunications or utilities. Do not assume every state-sponsored event is treated the same way.

Your incident response plan: decisions made in advance

Keep the insurer hotline, broker, IT provider and legal contacts available offline, with working after-hours numbers. Name who can isolate systems, approve expenditure and speak to clients. Include the breach assessment process, an incident log and draft communications. Review the plan annually and whenever people, systems or policies change, then rehearse it with leadership.

1. Detect, contain and preserve evidence. Isolate affected devices or accounts and retain logs. Avoid wiping or rebuilding systems before forensic evidence is captured.
2. Notify the insurer promptly. Activate the approved panel and obtain required consent before commissioning external work. Coordinate this with urgent containment.
3. Investigate and assess harm. Your IT provider supplies logs and system context; forensic specialists investigate exposure and legal advisers help assess notification duties.
4. Communicate and notify. Keep factual records and notify the regulator and affected people when required. Insurance approval does not suspend statutory obligations.
5. Recover and improve. Restore from clean backups, reset compromised credentials, close the entry point and document lessons and remediation.

A practical 90-day preparation plan

Use the first 30 days to assess your environment against a current proposal form and prioritise gaps. During days 31–60, address the highest risks: MFA, privileged access, endpoint coverage, patching and backup recovery. During days 61–90, assemble evidence, rehearse the response plan and review policy terms with your licensed broker. Timing depends on your starting point; completing a checklist does not guarantee acceptance or a lower premium.

The ACSC’s Essential Eight provides a useful foundation for controls such as MFA, patching, application control and backups. An assessment against it supports preparation, but does not replace an insurer’s own requirements.

Novaguard’s compliance work brings the controls and evidence together in a governance, risk and compliance (GRC) export: what is implemented, how it applies to your environment and the supporting records. Keep MFA reports, backup restore results, patch reports, training records and exercise dates current so proposal answers remain defensible. Your IT provider handles technical preparation; your licensed broker advises on cover, limits and wording.

What to do next

If you're not sure where your business actually stands against any of this, guessing is the expensive option. A Cyber Business Review is a lower-commitment way to get a real, documented look at your current security posture, including exactly the kind of evidence an insurer would ask for, without committing to a full switch. If you already know you want ongoing managed cyber security handling this properly, that's the fuller path.