Cyber Insurance

A cyber insurance proposal form asks a short list of questions about your controls, and ends with a declaration you sign. That declaration binds you to the accuracy of every answer, including answers supplied on your behalf by someone else, under the duty of disclosure in the Insurance Contracts Act 1984. Most forms tell you plainly to consult whoever manages your systems before signing, which is sound instruction that assumes somebody has actually looked.

The questions are not difficult to read, they are difficult to answer honestly. Whether multi-factor authentication covers every user with remote access, whether backups sit separately from the systems they protect and have been restored from inside the last year, whether patches land within thirty days, each of those is a matter of fact about your environment rather than a matter of opinion, and the answer is either known or it is assumed.

I read the form in front of you, question by question, against what is actually known about your environment, and give you the list of questions you cannot currently answer truthfully. Not the answers, the gaps. Nothing is drafted, nothing is certified, and nothing goes to your broker or your insurer.

That boundary is deliberate. Supplying answers to questions nobody has assessed is the arrangement this practice exists to criticise, and it would put me in the seat of the provider whose word you were meant to be checking.

The Essential Eight assessment is the engagement, and everything else here is derived from it or is part of it.

Your environment assessed against the ACSC Essential Eight Maturity Model, with evidence sighted for each requirement rather than taken on assurance, producing a maturity report that states where you actually sit. Alongside it, drafted answers for the form in front of you, each one traceable back to the evidence behind it, so the person signing the declaration can see what they are certifying.

360 Underwriting Solutions accepts an annual Essential Eight self-assessment at Maturity Level One in place of five separate control questions on its own form. That question is self-certified with no evidence attached, which makes ticking it the cheapest path through the page and the most consequential thing on it. An evidenced assessment is what makes the tick defensible.

I am not licensed to provide financial or insurance advice, and nothing here is that. I do not comment on whether you should buy cover, how much you need, which insurer or policy to choose, what a policy excludes, or whether a claim would be paid. Those belong with your broker.

What I do is narrower. I establish whether the technical statements on your proposal form are accurate, and where they are not, what it would take to make them so. The accuracy of the answers is my scope, the insurance is not.

I take no commission from any insurer, broker or underwriting agency, and I do not sell the remediation.

The work offered through robswain.au is one-off and self-contained by design. There is no retainer and no ongoing commitment: the engagement ends when the work is done, and you keep control of your own systems throughout.

Send me the form you have been asked to complete, or just your renewal date if it has not arrived yet. We will have a short scoping call to confirm what you need before anything is agreed. rob@robswain.au