Free cyber readiness scorecard
How do your client's cyber controls look to an underwriter?
Twelve questions every cyber insurer asks. Score them, see the gaps to close before applying, then send the client a branded scorecard.
Example figures. Change them to your client's.
1The twelve questions insurers ask
If you are not sure, say so. An underwriter would treat it as a no.
Multi-factor sign-in on email and remote accessMust have
Does everyone need a second step (an app or a key, not just a password) to get into email and to connect from outside the office?
2How it maps to Essential Eight
Insurers rarely require a formal Essential Eight assessment, but most of their questions map onto the eight strategies.
- Multi-factor sign-in on email and remote access. Essential Eight: multi-factor authentication
- Backups kept offline and tested. Essential Eight: regular backups
- Endpoint detection and response. Essential Eight: application control (related)
- Critical patches within 14 days. Essential Eight: patch applications and operating systems
- Admin rights kept to a few. Essential Eight: restrict administrative privileges
- Email filtering and link checks. Essential Eight: user application hardening (related)
- Phishing training and tests. Not an Essential Eight strategy; insurers ask anyway
- A written incident response plan. Supports the 72 hour ransomware reporting rule
- No open remote desktop. Essential Eight: user application hardening (related)
- Logs kept and watched. Supports incident response and reporting
- No unsupported software. Essential Eight: patch operating systems
- Suppliers' access controlled. Essential Eight: restrict administrative privileges (related)
Scores 68 out of 100 with an underwriter.
Expect questions
Cover is likely, but the insurer will want detail and may set tighter terms.
Underwriter's notes
- Are backups offline or immutable, and when was a restore last tested?
- How quickly are critical vulnerabilities patched on internet facing systems?
- How often do staff receive security awareness training and phishing simulations?
- Is there a tested incident response plan?
- Are security logs centrally collected and monitored?
Gaps to close, most important first
- PartlyBackups kept offline and tested. Keep one copy offline or immutable and test a full restore at least twice a year. Write down how long it took.
- PartlyCritical patches within 14 days. Set a 14 day target for critical patches, 48 hours for internet facing systems with known exploits.
- NoPhishing training and tests. Run short training each year and a practice phishing email each quarter.
- NoA written incident response plan. Write a one page plan with names and numbers, including the insurer's breach hotline, and walk through it once a year.
- Not sureLogs kept and watched. Keep sign-in and security logs for 90 days or more, and have someone (or a service) review alerts.
- PartlySuppliers' access controlled. List every supplier with access, require MFA and turn access off when it isn't in use.
Got the insurer's proposal form? Send it to the client as a chat with a free trial
What to tell your client
On the questions cyber insurers ask, your business scores 68 out of 100: expect questions. Closing the top gaps, starting with backups kept offline and tested, will help on price and terms.
Illustrative only, not advice. The policy wording and the insurer decide. Nothing you type leaves your browser unless you make the PDF.
Why it matters
Cyber crime costs businesses more every year
$56.6k
average cost of a cybercrime report from a small business, up 14% in a year.
ASD Annual Cyber Threat Report 2024-2599%
fewer account takeovers with multi-factor sign-in, the control insurers ask about first.
Microsoft Research, 2023
In plain English
Why the proposal form matters so much
Cyber insurers price on controls, not just turnover. The answers decide the premium, the excess and sometimes whether a claim is paid.
Some controls are must haves
Multi-factor sign-in, offline backups and endpoint detection. Without them many insurers decline or exclude ransomware.
Not sure means no
An underwriter treats an answer nobody can stand behind as a gap. Ask the IT provider before the form goes in.
A wrong yes can cost a claim
If a control was said to be in place and wasn't, the insurer may reduce or refuse a claim. Honest answers are the safe ones.
What underwriters look for
Three groups of controls, in the order insurers care about them
Proposal forms differ, but the questions behind them are the same everywhere. Get the first group right and the rest is negotiation.
Must haves
Without these many insurers decline or exclude ransomware. They are the first questions on every form.
- Multi-factor sign-in on email and remote access
- Backups kept offline and tested
- Endpoint detection and response
Expected
Missing these leads to follow up questions, higher excesses or sub-limits.
- Critical patches within 14 days
- Admin rights kept to a few
- Email filtering and link checks
- No open remote desktop
Good practice
These improve terms and make a claim smoother to handle.
- Phishing training and tests
- A written incident response plan
- Logs kept and watched
- No unsupported software
- Suppliers' access controlled
Paid a ransom? 72 hours to report it
Since 30 May 2025 a business with turnover over $3m must report a ransom payment to the Australian Signals Directorate within 72 hours, even when the insurer or an incident responder paid it. Enforcement began on 1 January 2026.
Department of Home AffairsA quick game
Spot the phish
Phishing is behind most attacks on businesses. Tap the part of each email that gives it away.
Email 1 of 3. Tap the giveaway.
From accounts@harbour-supplies.example
Updated bank details for this month's invoice
How brokers prepare a cyber placement
Three steps before the proposal form
- 1
Run the twelve questions early
Two or three months before renewal leaves time for the client to close a gap, which costs less than the premium it saves.
Marsh, twelve key cyber controls - 2
Get evidence, not ticks
Screenshots of MFA settings, a backup restore log, the EDR console. Insurers increasingly ask for proof.
- 3
Know the 72 hour rule
A business with turnover over $3m that pays a ransom must report it within 72 hours, even if the insurer paid. Build it into the incident plan.
Department of Home Affairs
The client PDF
A scorecard the client can hand to their IT provider
Your logo and details, the readiness score, the underwriter's view and each gap with what to do about it. It turns a proposal form into a to do list.
- Readiness score and verdict
- Gaps ranked by what insurers care about
- What the insurer will ask
- Mapping to the Essential Eight
How your cyber controls look to an insurer
68/100
Expect questionsGaps to close
- ☐ Backups kept offline and tested
- ☐ Critical patches within 14 days
- ☐ Phishing training and tests
- ☐ A written incident response plan
Test yourself
What do cyber underwriters really ask? Five questions
The proposal form decides the price, the terms and sometimes whether a claim is paid. See how well you know what is behind it.
Which control do almost all cyber insurers now insist on before they quote?
Questions brokers ask
Cyber readiness, answered
- Is this the same as an insurer's proposal form?
- No. Each insurer has its own form, but they ask about the same controls. This scorecard prepares the client so the real form is quick and accurate.
- How is the score worked out?
- Each control carries a weight for how much underwriters care about it. Yes scores the full weight, partly half and no or not sure nothing. A missing must have control caps the verdict whatever the score.
- Does it map to the Essential Eight?
- Yes. Each control shows the Essential Eight strategy it relates to. Insurers rarely require a formal assessment, but most of their questions map onto the eight.
- What about ransomware payment reporting?
- Businesses with turnover over $3m must report a ransom payment within 72 hours, including one made by their insurer. The incident response plan should say who does it.
- Does this guarantee cover?
- No. It shows how the controls are likely to be seen. Each insurer sets its own requirements and the final decision is theirs.
- Is my client's data stored?
- No. The scorecard runs in your browser. Answers only leave it if you make the PDF.
With a free trial
Send clients the questions, get the answers back filled in
Coverbound turns any insurer's proposal form into a chat your client can finish on their phone, then fills in the PDF. 14 days free, no card.
Find the gaps before the underwriter does
Twelve questions, five minutes, one scorecard to send.
More free tools