Cyber insurance renewals have become more difficult over the past few years. Premiums have risen. Requirements have tightened. Some businesses have struggled to get coverage at all.

If your renewal is coming up, here’s how to prepare.

The Current Market

What’s happening:

Insurers have paid out significant claims from ransomware and data breaches. They’ve responded by:

• Increasing premiums
• Tightening requirements
• Excluding some risks
• Requiring specific controls before offering coverage

For SMBs specifically:

Small businesses are feeling the squeeze. Insurance that was straightforward to obtain five years ago now requires demonstrating security controls.

The good news:

The market is stabilising somewhat. If you have good security practices, coverage is available at reasonable rates. The businesses struggling are those with inadequate controls.

What Insurers Want to See

Based on current market requirements, here’s what most cyber insurers expect:

Mandatory for most policies:

Multi-factor authentication: MFA on email. MFA on VPN. MFA on remote access. MFA on admin accounts. This is non-negotiable for most insurers now.

Backup and recovery: Regular backups. Offline or immutable backup copies. Tested recovery capability.

Patch management: Evidence that you patch systems regularly, especially for critical vulnerabilities.

Endpoint protection: Modern endpoint protection (EDR preferred over traditional antivirus).

Commonly required:

Security awareness training: Evidence that employees receive phishing and security training.

Email security: Advanced email filtering. DMARC/SPF/DKIM configured.

Privileged access management: Separation of admin and daily accounts. Limited admin access.

Increasingly asked:

Incident response plan: Documented plan for responding to security incidents.

Vendor risk management: Assessment of third-party security, especially for critical suppliers.

Vulnerability management: Regular vulnerability scanning and remediation.

The Application Process

Cyber insurance applications have become more detailed.

Typical questions:

• Do you require MFA for all remote access?
• How quickly do you apply critical patches?
• Do you maintain offline or immutable backups?
• Do you conduct security awareness training?
• Do you have an incident response plan?
• Have you had a cyber incident in the past 5 years?

How to answer well:

Be honest. Misrepresentation can void coverage. If a question asks whether you do something and you don’t, the answer is no.

Provide context where helpful. “We require MFA on all external-facing systems and are implementing it for internal systems by Q3” is better than a simple no.

Evidence helps. If you can attach documentation - security policies, training records, configuration screenshots - do so.

Preparing for Renewal

Start 90 days before renewal:

This gives you time to address gaps and gather documentation.

Week 1-2: Assessment

Review your current security posture against typical insurance requirements:

• MFA coverage - where is it and where isn’t it?
• Backup status - are they current, tested, and protected?
• Patching status - how quickly are you applying patches?
• Training - when did employees last complete security training?
• Incident response - do you have a documented plan?

Week 3-6: Gap closure

Address the most critical gaps:

• Extend MFA to any missing systems
• Verify and test backups
• Update patching processes
• Schedule security training
• Document incident response procedures

Week 7-10: Documentation

Gather evidence of your controls:

• MFA configuration screenshots
• Backup logs and test results
• Patching reports
• Training completion records
• Policy documents

Week 11-12: Application

Complete the insurance application with accurate, well-documented answers.

Common Pitfalls

Underestimating MFA requirements:

Insurers mean MFA everywhere. Email, VPN, admin access, cloud services. “We have MFA on most things” isn’t enough.

Untested backups:

Having backups isn’t the same as having working backups. If you haven’t tested a restore recently, you can’t honestly say your backups work.

Outdated training:

Security training from two years ago doesn’t satisfy current requirements. Most insurers want evidence of recent (within 12 months) training.

Missing documentation:

Verbal claims are weak. Written policies, configuration evidence, and audit logs are strong.

Previous incidents:

If you’ve had an incident, be prepared to explain what happened and what you changed. Insurers want to see lessons learned.

Working with Your Broker

A good insurance broker adds value:

What they should do:

• Understand cyber insurance market specifics
• Help translate security status into insurance language
• Advocate with underwriters on your behalf
• Shop multiple carriers for competitive rates
• Explain coverage gaps and options

Questions to ask your broker:

• What security controls will most improve our application?
• Which insurers are best for businesses like ours?
• What exclusions should we be aware of?
• How do our premiums compare to similar businesses?

If your broker doesn’t understand cyber insurance well, consider finding one who does.

Coverage Considerations

What to look for in coverage:

First-party coverage:

• Data restoration costs
• Business interruption
• Cyber extortion/ransomware
• Crisis management
• Forensic investigation

Third-party coverage:

• Privacy liability
• Network security liability
• Media liability
• Regulatory defence and penalties

Sub-limits and exclusions: Pay attention to sub-limits (lower coverage for specific events) and exclusions (things not covered at all).

Common exclusions:

• War and terrorism (watch for cyber operation exclusions)
• Prior known issues
• Unencrypted data in some cases
• Failure to maintain minimum security standards
• Social engineering (sometimes excluded or sub-limited)

The Premium Discussion

Factors affecting premium:

• Your industry (some are higher risk)
• Your revenue
• Data you hold (PII, health, financial)
• Your security controls
• Claims history
• Coverage limits and deductibles

Ways to potentially reduce premiums:

• Demonstrate strong security controls
• Accept higher deductibles
• Lower coverage limits (carefully)
• Improve claims history (don’t have incidents)

Reality check: Premiums have increased significantly industry-wide. Some increase may be unavoidable. The goal is a fair premium for your risk profile, not necessarily a lower premium than last year.

If You Struggle to Get Coverage

Some businesses face challenges getting cyber coverage:

Reasons for difficulty:

• Previous significant claims
• Inadequate security controls
• High-risk industry
• Large data holdings
• Outdated systems

Options:

• Work with a specialty broker
• Improve security controls and reapply
• Accept higher premiums or deductibles
• Consider excess and surplus lines carriers
• Explore captive or alternative risk transfer

Getting help from security specialists to improve your posture can make you insurable. AI consultants Sydney and similar firms can help implement the controls insurers require.

Post-Renewal Maintenance

Getting the policy is step one. Maintaining compliance matters:

Ongoing requirements:

• Maintain the controls you represented
• Report incidents promptly (usually 24-48 hours)
• Document changes to your environment
• Keep evidence of security practices

Common policy requirements:

• Notify insurer of significant incidents
• Use approved incident response vendors
• Maintain security controls throughout policy period

Documentation to maintain:

• Security policies (updated annually)
• Training records
• Backup and patching logs
• Access reviews
• Incident response tests

The Essential Eight Connection

The Essential Eight framework aligns well with insurance requirements:

Essential Eight Control	Insurance Relevance
MFA	Almost always required
Patch Applications	Commonly required
Patch OS	Commonly required
Restrict Admin Privileges	Commonly asked
Application Control	Sometimes asked
Office Macros	Sometimes asked
User App Hardening	Less commonly asked
Backups	Almost always required

If you’re working toward Essential Eight compliance, you’re largely addressing insurance requirements too.

Working with Security Specialists

For businesses that need help preparing for renewal, Team400 and similar firms can:

• Assess current security posture against insurance requirements
• Implement required controls
• Prepare documentation and evidence
• Advise on policy coverage
• Support ongoing compliance

The investment in getting security right often pays for itself in better insurance outcomes.

Timeline Summary

90 days before renewal:

• Start assessment
• Identify gaps

60 days before renewal:

• Close critical gaps
• Implement missing controls

30 days before renewal:

• Gather documentation
• Prepare evidence

Renewal:

• Complete application accurately
• Provide supporting documentation
• Work with broker on best outcome

Post-renewal:

• Maintain controls
• Document practices
• Prepare for next year

Final Thought

Cyber insurance renewals have become a forcing function for security improvement. The controls insurers require are the controls you should have anyway.

Use the renewal process as motivation to assess and improve your security posture. The documentation you prepare for insurance serves other purposes - client questions, internal governance, compliance requirements.

Being well-prepared for renewal means being better protected against the threats insurance covers.

That’s a good outcome regardless of premium.