Does cyber insurance replace controls like the Essential Eight?
No. ASD's Essential Eight FAQ says an organisation relying on risk transference, such as sourcing cyber insurance, instead of implementing an entire mitigation strategy is assessed at Maturity Level Zero for that strategy and overall. A policy pays after a loss; it does not change how a missing control scores.
In detail
ASD's FAQ treats sourcing cyber insurance as risk transference, which leaves the mitigation strategy itself unimplemented, and it assesses risk acceptance without compensating controls the same way, with the zero applying to the whole implementation. A compensating control assessed as not suitable drops the strategy to the next lowest maturity level it qualifies for, or Maturity Level Zero.
ASD's maturity model says any exception to a requirement should be documented and approved through an appropriate process, and reviewed on a regular basis. It treats the Essential Eight as a minimum set of preventative measures and says organisations need to implement additional measures where their environment warrants it.
| What the insurer wants to know | The strategy behind it |
|---|---|
| Whether MFA covers every identity, by which method and with what exceptions | Multi-factor authentication |
| Whether backups sit offline or cannot be altered, and were restored in a test | Regular backups |
| The days between a vendor's patch release and its installation | Patch applications and patch operating systems |
| Whether administrative rights are limited and the list is reviewed | Restrict administrative privileges |
The proposal form is underwriting input and a disclosure document. The Insurance Contracts Act 1984 (Cth) keeps the duty of disclosure in section 21 for contracts other than consumer insurance contracts, in Part IV, Division 1 of the Act. Have the person who signs the proposal check each yes against the export that supports it before the form goes back.
Patching, administrative privilege, multi-factor authentication and backups appear on proposal forms and in the Essential Eight alike. The difference is what follows the answer: an assessment finding is a gap the business schedules work against, while a proposal answer is a statement the insurer can test after a loss.
- List the strategies not implemented at all; each sits at Maturity Level Zero whether or not a policy responds.
- Write each approved exception into the exception register with its compensating control, the approver and the next review date.
- Answer each proposal question at the scope the evidence supports, keeping the sign-in log export that shows MFA coverage.
For an Australian organisation
For an organisation the Privacy Act 1988 covers, a data breach likely to result in serious harm is notified to affected individuals and the OAIC under the Notifiable Data Breaches scheme, whatever the policy covers.
ASD says Maturity Level One may be suitable for small to medium enterprises, and holding cyber insurance does not lift a strategy that has not been implemented above Maturity Level Zero.
Sources
- ASD, Essential Eight maturity model FAQRead 31 Oct 2026, opens in a new tab
- ASD, Essential Eight maturity modelRead 31 Oct 2026, opens in a new tab
- Black Shard, What Australian cyber insurers check before they quote youRead 31 Oct 2026
- Federal Register of Legislation, Insurance Contracts Act 1984Read 31 Oct 2026, opens in a new tab
- OAIC, About the Notifiable Data Breaches schemeRead 31 Oct 2026, opens in a new tab
