Cyber insurance: what it covers for small business

What cyber insurance is and who needs it

Cyber insurance helps a business pay for the costs of a data breach, ransomware attack, email compromise or system outage. It is aimed at any organisation that holds customer or staff records, takes payments or relies on computer systems to trade.

No law requires a business to buy it. Legal duties do drive some of the costs it covers:

  • Notifiable Data Breaches scheme: organisations covered by the Privacy Act must notify affected people and the Office of the Australian Information Commissioner when a data breach is likely to result in serious harm. The Act generally applies to organisations with annual turnover above $3 million, and to some smaller ones such as private health service providers.
  • Ransomware payment reporting: cyber.gov.au states that businesses with annual turnover above $3 million must report a ransomware or cyber extortion payment within 72 hours.

Some customers and government contracts also ask suppliers to hold cyber cover.

What is usually covered, and common exclusions

Policies usually have two parts. First-party cover pays the business's own costs:

  • incident response, IT forensics and legal advice
  • restoring data and systems
  • lost income while systems are down
  • notifying affected people and offering credit monitoring
  • specialist help to respond to an extortion demand.

Third-party cover pays claims made against the business, for example by customers whose data was exposed, and the cost of responding to a regulator's investigation.

Common exclusions and limits:

  • incidents that began before the policy started
  • failure to maintain security controls you told the insurer were in place
  • funds transferred after a fake invoice or impersonation scam, unless a social engineering extension is bought
  • outages of power, internet or cloud infrastructure outside your control
  • acts of war and some state-backed attacks
  • the cost of upgrading systems beyond what they were
  • fines that cannot be insured by law.

The Australian Government strongly discourages paying a ransom. Paying does not guarantee that data will be restored or kept private.

How it is sold, and when a broker is the usual route

  • Brokers: most stand-alone cyber policies are arranged by brokers.
  • Underwriting agencies: specialist cyber agencies write cover on behalf of insurers, including Lloyd's underwriters, and often supply the incident response service.
  • Direct insurers: some sell online cyber policies to small businesses.
  • Add-ons: a business package may include a cyber section, usually with a low limit and narrower cover.

A broker is the normal route once a business holds sensitive data, needs a limit above a basic add-on, or must meet a contract requirement. Wordings differ a great deal between insurers. Check a broker's licence on the ASIC professional registers.

What makes cyber cover hard or expensive to get

Insurers usually ask detailed questions about security before they quote. Cover is harder to get, or costs more, when:

  • multi-factor authentication is not used for email and remote access
  • backups are not kept offline or tested
  • software is not patched promptly
  • the business holds health, financial or identity data
  • the business provides IT services to others
  • there has been an earlier incident.

The answers form part of your disclosure. If they are wrong, a claim can be reduced or refused. The Australian Signals Directorate's guidance is that cyber insurance is not a substitute for investing in security.

Questions to ask before buying

  • Is social engineering or funds transfer fraud covered, and to what limit?
  • Is business interruption covered, and after what waiting period?
  • Does cover extend to an outage at my cloud or software provider?
  • Who runs the incident response, and is there a 24-hour number?
  • Which security controls are conditions of cover?
  • Is there a retroactive date for breaches that began earlier?
  • Are regulatory investigation costs included?
  • What is excluded as an act of war?

Where to complain

Complain to the insurer in writing first and ask for its internal dispute resolution process. Complain to the broker if the problem is their advice or service.

The Australian Financial Complaints Authority (AFCA) is the free external complaints body and accepts complaints from small businesses with fewer than 100 employees. Its rules cover only some kinds of business policy. Ask AFCA on 1800 931 678 whether a cyber policy dispute is within its rules. If not, consider independent legal advice.

Find a licensed broker

Browse businesses licensed to arrange general insurance in your city, or search every state.

Sources

Last checked: 2026-10-06

Scroll to Top