Cyber Insurance Australia — What IT Controls Do Insurers Require in 2026?

Cyber insurance in Australia has changed dramatically. Three years ago, most businesses could get a policy with minimal questions asked. In 2026, insurers are requiring real evidence of security controls before issuing coverage — and they're declining businesses that can't demonstrate them.

Why cyber insurance requirements have tightened

After a wave of high-profile Australian data breaches and record ransomware payouts, insurers repriced and restructured their products. Premiums increased significantly, coverage limits tightened, and exclusions multiplied. The insurers still offering comprehensive cyber coverage are doing so only for businesses that demonstrably manage their risk.

What Australian insurers are now requiring

Multi-factor authentication (MFA)

MFA on all internet-facing systems — email, VPN, remote desktop, cloud platforms — is now a near-universal requirement. Many policies exclude claims where MFA was absent on the breached system.

Endpoint Detection and Response (EDR)

Traditional antivirus is no longer acceptable to most Australian cyber insurers. EDR — which detects and responds to behavioural threats, not just known signatures — is increasingly required.

Regular patching

Documented patching processes with evidence that critical patches are applied within 48 hours are now standard requirements. Unpatched critical vulnerabilities are the most common exclusion trigger.

Tested backups

Insurers want to see immutable, offsite backups with documented and tested restore procedures. Backups that haven't been tested are treated as untested — insurers know that untested backups fail at the worst time.

Privileged access management

Restricting admin rights and having documented processes for who has privileged access is increasingly required. Businesses where all staff have admin rights are becoming uninsurable.

The Essential Eight and cyber insurance

The good news: achieving Essential Eight Maturity Level 1 covers most of what Australian cyber insurers require. ML1 addresses MFA, patching, backups, application control and admin privilege restriction — the five most common insurer requirements. Businesses with documented ML1 compliance typically find the insurance application process significantly smoother.

What to do if you're not sure you qualify

Before renewing or applying for cyber insurance, get a security gap assessment. Understanding where you stand against the insurer's requirements — and closing the gaps before the application — is far cheaper than being declined or having a claim denied.