Renewing cyber insurance can feel like an IT audit. Your insurer may ask whether multi-factor authentication is enabled, how backups are protected, whether security patches are applied and what would happen if ransomware affected your systems. The challenge is not finding the answers your insurer wants to hear—it is understanding your actual security controls and documenting them accurately.
For Sydney small and medium-sized businesses, preparing early can make the renewal process smoother and expose gaps worth addressing before an incident. This guide explains the questions you are likely to encounter, what evidence to gather and how your IT support provider can help.
Why cyber insurance renewal questionnaires matter
Cyber insurers use proposal and renewal questionnaires to assess the risks they may be agreeing to cover. The answers can influence underwriting decisions, premiums, deductibles, exclusions and whether cover is offered at all. Requirements vary by insurer, policy wording, industry and business size.
Important: Never tick “Yes” to a control that is only partially implemented or merely planned. If a question is unclear, ask your broker or insurer how it should be interpreted. Keep a dated copy of your responses and supporting evidence. This article is general information, not insurance or legal advice.
1. Start preparing before your renewal date
Do not leave the questionnaire until the week your policy expires. Give yourself time to coordinate with your broker, management and IT provider, identify missing controls and obtain clarification where needed.
- Obtain the current questionnaire and policy schedule.
- Review last year's answers and note what has changed.
- Identify who owns each question: IT, operations, finance, HR or management.
- Record which controls are in place, partially implemented or not implemented.
- Agree on remediation priorities and realistic completion dates.
A simple evidence register with the question, responsible person, current status, proof and review date can save considerable time.
2. Check multi-factor authentication (MFA)
MFA is one of the most frequently discussed controls in cyber insurance assessments. Insurers may ask about MFA for email, Microsoft 365, remote access, privileged accounts, cloud administration and other critical systems.
Check where MFA is enforced, not just whether your organisation has the feature available. A handful of protected administrator accounts does not necessarily mean all users or remote access methods are covered.
Evidence to prepare
- Identity-provider or Microsoft 365 authentication policies
- Reports showing coverage and any exclusions
- Remote-access and VPN authentication settings
- Records of break-glass accounts and compensating controls, where applicable
For help reviewing your cloud identity setup, see ITNetFix's Microsoft 365 support services.
3. Confirm endpoint protection and device management
Insurers may ask whether laptops, desktops and servers use antivirus, endpoint detection and response (EDR), centrally managed security tools or disk encryption.
Inventory the devices that access company data, including remote and occasionally used devices. Confirm which are actively managed, which security tools are installed and whether alerts are reviewed by someone with responsibility to act.
A security product licence is not the same as full deployment. Ask your IT team for a current device coverage report and document exceptions.
4. Review patch management and unsupported software
Unpatched vulnerabilities can expose systems to avoidable risk. Questionnaires may ask how quickly critical updates are applied, whether updates are tracked and whether unsupported operating systems remain in use.
- Maintain a list of operating systems, applications, firewalls and servers.
- Document the process for testing and applying security updates.
- Record exceptions, overdue patches and mitigation measures.
- Plan upgrades or isolation for end-of-support systems.
Keep patch-compliance reports and change records rather than relying solely on a written policy.
5. Prove your backups can be restored
Backup questions may cover frequency, encryption, offline or immutable copies, separation from production credentials and recovery testing. Some insurers distinguish between having backups and demonstrating that restoration works.
Prepare a list of critical systems, backup schedules, retention periods, monitoring responsibilities and the dates and outcomes of recent restore tests. Consider what would happen if a compromised administrator account also had access to your backup environment.
Learn more about ITNetFix backup and recovery services.
6. Review email security and staff awareness
Business email compromise and phishing can lead to payment fraud, account takeover and data loss. Insurers may ask about email filtering, phishing protection, staff awareness training and procedures for changing bank details.
Useful evidence includes training records, documented payment-verification procedures, email authentication settings and phishing-reporting instructions. Training alone is not a substitute for technical controls and business processes.
7. Document privileged access and remote working controls
Review who has administrator access to Microsoft 365, servers, firewalls, backups and key business applications. Limit privileges to those who need them, review access periodically and remove access promptly when employees leave.
For remote work, document approved access methods, device security requirements and the use of MFA. Make sure the questionnaire answers reflect contractors and third-party support accounts where relevant.
8. Prepare your incident response and business continuity plans
Some insurers ask whether you have a written incident response plan, named contacts, an external response partner or procedures for notifying affected parties.
A useful plan identifies who makes decisions, how systems are isolated, who contacts your insurer or broker, where evidence is preserved and how business operations can continue. Run a tabletop exercise so key people understand their roles.
Do not assume a standard managed IT agreement includes forensic investigation, legal advice or a 24-hour incident response retainer. Confirm the scope of each provider's responsibilities.
9. Check third-party and cloud service responsibilities
Outsourcing IT does not automatically transfer every security obligation. Ask your managed service provider, cloud vendors and software suppliers which protections they operate and which remain your responsibility.
For example, a Microsoft 365 subscription does not by itself confirm that your identity policies, user access, data retention and backups meet the questionnaire's requirements. Request written confirmation where necessary.
10. Create an evidence pack for your insurer
Organise the material so your business can support each declaration without exposing sensitive credentials or unnecessary personal information.
| Control area | Possible evidence | Who can help |
|---|---|---|
| MFA | Policy settings, coverage reports | IT / Microsoft 365 administrator |
| Endpoint security | Device inventory, protection status | IT support provider |
| Patching | Update reports, exception register | IT support provider |
| Backups | Backup reports, restore test results | Backup administrator |
| Awareness | Training logs, phishing procedures | HR / management |
| Incident response | Response plan, exercise records | Management / security advisers |
Evidence should be current, accurate and stored securely. Share it only through channels approved by your broker or insurer.
Common mistakes that delay cyber insurance renewals
- Assuming a tool is fully deployed: a product may be licensed but not installed everywhere.
- Copying last year's answers: staff, devices and configurations may have changed.
- Overstating controls: “Yes” may be inaccurate when exceptions exist.
- Ignoring backup restoration: successful backup jobs do not prove recovery capability.
- Leaving ownership unclear: nobody knows who responds to alerts or incidents.
- Waiting until the deadline: remediation and evidence gathering take time.
What if you cannot answer “Yes” to a question?
Do not conceal the gap. Clarify the insurer's wording, disclose the actual situation accurately and ask your broker what additional information is needed. Your IT provider can help assess the technical risk, propose remediation and document progress. The insurer decides how the information affects underwriting or cover.
Prioritise improvements that reduce real business risk—not just those that make a questionnaire easier to complete. For guidance on broader protective measures, review the Australian Cyber Security Centre resources.
How ITNetFix can help your Sydney business prepare
ITNetFix can help businesses review their existing IT environment and identify practical areas to improve before renewal discussions. Depending on the agreed scope, this may include Microsoft 365 and MFA configuration reviews, endpoint security, patching, backups, network security and IT documentation.
Explore our cybersecurity services, IT support in Sydney and managed IT support packages. For a broader comparison of support approaches, read Managed IT Services vs Break-Fix IT Support.
Frequently asked questions
Does cyber insurance require MFA?
Many insurers ask about MFA, but exact requirements vary by policy and insurer. Check the wording and confirm which users, accounts and access methods are in scope.
Will an MSP complete my questionnaire for me?
An MSP can provide technical evidence and help explain controls it manages. The business should review and approve its declarations, with insurance-specific questions directed to its broker or insurer.
What happens if a security control is missing?
The insurer may request clarification, impose conditions, change pricing or make another underwriting decision. Do not assume a particular outcome; discuss it with your broker.
How early should we start preparing?
Start well before the renewal deadline so there is time to validate controls, gather evidence and address important gaps. The appropriate lead time depends on the complexity of your environment.
Does passing the questionnaire guarantee a future claim will be paid?
No. Coverage and claims decisions depend on the policy terms, facts and applicable law. Accurate disclosures and good security practices are important, but they do not guarantee a claim outcome.
Final thoughts
A cyber insurance renewal questionnaire is a useful opportunity to check whether your business's security practices match its assumptions. The strongest approach is to verify controls, document evidence, address gaps and answer every question accurately.
With the right preparation, Sydney businesses can approach renewal discussions with clearer information and a stronger understanding of their cyber risks.
Preparing for a Cyber Insurance Renewal?
ITNetFix can help review your IT security arrangements, identify technical gaps and prepare relevant system information for discussions with your insurer or broker.
Discuss Your IT Security Requirements →