--- title: "Cyber Insurance: Cover & Requirements | StartCloud" description: "What cyber insurance covers, the security controls insurers now require before they will cover you, and how to become insurable and lower your premium." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://startcloud.au/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://startcloud.au/resources" }, { "@type": "ListItem", "position": 3, "name": "Cyber Insurance", "item": "https://startcloud.au/resources/cyber-insurance-what-it-covers" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What does cyber insurance actually cover?", "acceptedAnswer": { "@type": "Answer", "text": "Two broad areas. First-party covers your own recovery: incident response, data recovery, business interruption, and sometimes ransom and extortion costs. Third-party covers your liability to others: legal defence, breach notification, and claims from clients whose data was exposed. Exact cover varies by policy, so read the schedule." } }, { "@type": "Question", "name": "What do insurers require before they will cover us?", "acceptedAnswer": { "@type": "Answer", "text": "Increasingly, controls like multi-factor authentication, tested backups, modern endpoint protection, timely patching, staff training, and an incident response plan. Many of these line up directly with the ACSC Essential Eight. If you cannot demonstrate them, you may be declined, pay a higher premium, or find a claim reduced." } }, { "@type": "Question", "name": "Can a claim be refused if our security was poor?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. If you declared controls you did not actually have, or a breach traces back to a control you were required to maintain and did not, an insurer can reduce or refuse a claim. Cyber insurance is a backstop, not a substitute for doing the basics." } }, { "@type": "Question", "name": "How can we lower our premium?", "acceptedAnswer": { "@type": "Answer", "text": "Put the controls insurers ask for in place and be able to prove it. Aligning with the Essential Eight, running MFA everywhere, and having tested backups and monitoring not only reduces your risk, it often reduces your premium and makes you insurable in the first place." } } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "Cyber insurance: what it covers and what insurers now require", "description": "What cyber insurance covers, the controls insurers require before they will cover you, and how to become insurable and lower your premium.", "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "publisher": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au", "logo": { "@type": "ImageObject", "url": "https://startcloud.au/startcloud-logo.png" } }, "datePublished": "2026-07-06", "dateModified": "2026-07-06", "image": "https://startcloud.au/og-image.png", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://startcloud.au/resources/cyber-insurance-what-it-covers" } } ] ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Overview Short Version What It Covers What Insurers Require Becoming Insurable The Gotchas Verdict FAQ Related A plain-English deep dive into cyber insurance for small and mid-sized businesses. Explains what it covers (first-party recovery and third-party liability), the security controls insurers now require before they will cover you (MFA, tested backups, EDR, patching, training, incident response), how to become insurable and lower your premium, and the common exclusions that trip businesses up. Cyber insurance is a backstop, not a substitute for the basics. [Home](/)[Resources](/resources)Cyber Insurance Risk & Compliance Guide What it covers, and what it now demands # Cyber insurance: what it covers and what insurers now require Cyber insurance has gone from a nice-to-have to something clients and boards expect. But the market has tightened, and insurers now want proof you are doing the basics before they will cover you. Here is what a policy actually does, and what you need in place to get one. StartCloud 6 July 2026 8 min read The short version ## The short version **Cyber insurance covers two things: your own recovery costs after an incident, and your liability to others whose data was affected.** The catch is that insurers now require security controls before they will cover you, and many of them line up with the [Essential Eight](/cybersecurity/essential-eight): MFA, tested backups, endpoint protection, patching, and training. **It is a backstop, not a substitute for the basics.** Do the basics and you are both safer and cheaper to insure. Skip them and a claim can be reduced or refused. What it covers ## The two sides of a policy ### Your own recovery (first-party) The cost of getting your business back: incident response, data recovery, business interruption while you are down, and in some cases a ransom payment and cyber extortion support. ### Liability to others (third-party) The costs when someone else is affected: legal defence, breach notification, and claims from clients whose data was exposed through you. The requirements ## What insurers now expect you to have Cyber insurance used to be easy to get and cheap. After years of large claims, insurers tightened up. Most now ask you to declare specific controls, and you may be declined or pay more without them: - Multi-factor authentication on email, remote access, and admin accounts - Regular, tested backups that are kept separate from your main systems - Endpoint protection (modern EDR, not just basic antivirus) - Timely patching of operating systems and applications - Security awareness training for staff - A documented incident response plan If that list looks familiar, it should: it is essentially the [Essential Eight](/cybersecurity/essential-eight) in insurance language. Becoming insurable ## How to get covered, and pay less The good news is that the work you do to become insurable is the same work that actually protects your business. Put multi-factor authentication everywhere, get tested backups in place, run modern endpoint protection, keep systems patched, and train your team. Then be able to prove it. That last part matters. Insurers want evidence, not promises, and so do the auditors and clients who increasingly ask the same questions. A managed provider can put these controls in place and produce the documentation that goes on the insurance application, which is often what turns a declined or expensive quote into a reasonable one. The gotchas ## The traps to watch for **Declaring controls you do not have.** If you tick the box for MFA on the application but have not actually rolled it out, a claim tied to that gap can be reduced or refused. Only declare what is genuinely in place. Beyond that, watch for exclusions in the fine print, low sub-limits on the cover that matters most to you, and requirements to maintain controls throughout the policy, not just at sign-up. Read the schedule, and if in doubt, get someone technical to review the security questions with you before you answer them. Verdict ## The takeaway Cyber insurance is worth having, but treat it as the last line, not the first. The controls insurers demand are the same ones that stop most incidents happening in the first place, so the smart move is to build them because they protect you, and let the cheaper, easier insurance follow. We help Perth businesses put those controls in place and produce the evidence insurers and clients ask for. If you have an application to fill in, or a renewal with new security questions, that is exactly the kind of thing our [managed security service](/cybersecurity/mssp) handles. [Explore managed cybersecurity](/cybersecurity-perth)[Try the free Essential Eight checklist](/cybersecurity/essential-eight-checklist) FAQ ## Common questions ### What does cyber insurance actually cover? Two broad areas. First-party covers your own recovery: incident response, data recovery, business interruption, and sometimes ransom and extortion costs. Third-party covers your liability to others: legal defence, breach notification, and claims from clients whose data was exposed. Exact cover varies by policy, so read the schedule. ### What do insurers require before they will cover us? Increasingly, controls like multi-factor authentication, tested backups, modern endpoint protection, timely patching, staff training, and an incident response plan. Many of these line up directly with the ACSC Essential Eight. If you cannot demonstrate them, you may be declined, pay a higher premium, or find a claim reduced. ### Can a claim be refused if our security was poor? Yes. If you declared controls you did not actually have, or a breach traces back to a control you were required to maintain and did not, an insurer can reduce or refuse a claim. Cyber insurance is a backstop, not a substitute for doing the basics. ### How can we lower our premium? Put the controls insurers ask for in place and be able to prove it. Aligning with the Essential Eight, running MFA everywhere, and having tested backups and monitoring not only reduces your risk, it often reduces your premium and makes you insurable in the first place. Keep reading ## Related pages [ Framework ### Essential Eight The controls insurers ask for, explained. Assessment and implementation for Perth businesses. Service ](/cybersecurity/essential-eight)[ Managed security ### Managed Security (MSSP) 24/7 monitoring and the controls that keep you insurable, managed for you. Service ](/cybersecurity/mssp)[ Deep dive ### MFA & Email Compromise The scam behind many cyber claims, and the controls that stop it. Guide ](/resources/mfa-business-email-compromise) ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution