Australia
Cyber insurance proposal form questions, and the rule behind each
Australian cyber proposal forms ask about the same controls again and again: multi-factor authentication, backups, patching, administrator accounts, macros, email filtering, training, and what the business does after an incident. Each one below has a page with the Essential Eight requirement behind it at Maturity Level One or Two, and the privacy lines when the Privacy Act applies.
The controls
- Staff sign in to email and the online services that hold business data (office suite, accounting, practice or client software) with multi-factor authentication
- Remote access (VPN, remote desktop) and every administrator account use multi-factor authentication
- Backups are kept in a secure and resilient way (an isolated, offline or unchangeable copy), and ordinary staff accounts cannot change or delete them
- Security patches for internet-facing services and devices (websites, remote access, firewalls, email gateways) are applied within the timeframes in the requirement
- Administrators use a separate privileged account and environment for admin work only, with no internet or email on it
- Macros in office files from the internet are blocked, macros are off for staff with no business need, are scanned, and users cannot change the settings
- Inbound email is scanned for malware and phishing with unneeded attachment types blocked, and the domain publishes DMARC
- Staff are trained to recognise phishing and other social engineering, and to report a suspected incident
- There is a written cyber security incident response plan, it is enacted when an incident is identified, and incidents are reported internally and to the authority the rule names
- A data breach response plan exists, and a suspected data breach is assessed within the 30 days the Notifiable Data Breaches scheme sets
Start from the template, or mark the controls in the control list. How the schedule works.
Questions
- Does this page say the business can be covered?
- No. It shows the gaps and the rule behind each; cover is the insurer's decision.
- What does it cost?
- One applicant on screen is free in any jurisdiction. Saving clocks and the applicant link are on Solo.