What Is Cyber Insurance?

Cyber insurance, referred to here as Cyber Liability Insurance, is designed to help a business with claims, losses and response costs arising from a covered cyber breach, cyber attack or other cyber incident. Depending on the policy, it may help with investigating an incident, restoring data, responding to affected customers and defending related claims.

For a contractor, the issue could start with an email account, customer records or the software used to organise jobs. The consequences may involve both your business and the people whose information you hold. Cover depends on the policy’s terms, conditions, limits and exclusions.

Contractor Cover focuses on insurance for Australian contractors, tradies and small businesses, drawing on more than 20 years of industry experience through Elliott Insurance Brokers.

What Is Cyber Insurance Designed For?

Cyber Liability Insurance addresses certain financial consequences of a covered cyber incident. Its scope can include costs your business incurs and claims made against it. Insurers describe these as first-party cover and third-party liability cover.

First-Party Cover: Your Business’s Costs

First-Party cover concerns costs or losses your business suffers. Depending on the policy, these may include forensic investigation, data recovery, incident response and business interruption caused by a covered cyber event. For example, a plumbing contractor could lose access to its electronic job records after an attack. The contractor needs to find out what happened and recover the information used to schedule work. Those are questions about the business’s own response and recovery costs. The incident, costs and affected systems would need to fall within the policy wording for cover to respond.

Third-Party Cover: Claims Against Your Business

Third-Party liability cover concerns claims customers or other parties make against your business following a cyber or data security incident. For example, a client might allege that a breach of your business systems exposed their confidential information and caused them loss. Depending on the policy, cover may extend to that claim and associated legal costs. This is a different question from the cost of restoring your own files. One incident could raise both issues, but the insurer would assess each part against the relevant cover, conditions and exclusions.

When Contractors May Consider Cyber Cover

Cyber insurance may be relevant if you store customer information, use cloud software, process electronic payments or access client systems. Think about the information and accounts you need to complete a normal working day. An electrician might keep customer addresses, quotes and job photographs in an online system. A bookkeeper might access client records through several accounts. A small building business might organise supplier payments and subcontractor schedules by email. These are exposures to discuss when comparing cover. Start by listing the systems you use, the information you hold and the work you could not complete if you lost access. Include the records held on phones and laptops as well as information stored by service providers.

What Cyber Insurance May Cover

Depending on the policy, Cyber Liability Insurance may cover data breaches, theft or loss of customer information, network security breaches, cybercrime, cyber extortion and ransomware. The response costs and losses covered can differ between insurers.

Investigation and Data Recovery

After a covered cyber incident, a policy may help with forensic investigation and data recovery or restoration. Forensic investigation means examining what happened and which systems or information were affected. For a contractor, the practical questions might concern missing job files, an accessed email account or changes to customer records. Recovery may involve restoring affected information. Data restoration, hardware repair or replacement and system improvements are separate costs. Whether each is covered depends on the policy wording.

Notification, Response and Related Claims

Policies may include notification and incident response costs, crisis management and reputation protection costs, legal costs associated with covered claims, and third-party claims arising from data or network security breaches. For example, a contractor whose customer records have been exposed may need help responding to the incident and communicating with affected people. Whether notification is legally required is a separate question from whether the policy covers its cost. Certain fines and penalties may be covered only where the policy provides for them and they are legally insurable. Do not assume that a privacy breach makes every resulting expense an insured cost.

Business Interruption After a Cyber Event

A cyber policy may cover business interruption following specified incidents, including some system failures or human errors where included. Consider a maintenance business that cannot access its job scheduling software after an attack. The policy would need to respond to the cause and resulting interruption before a loss could be covered. Check which systems, events, waiting periods and financial losses the business interruption provisions address.

Ransomware and Cyber Extortion

Cyber extortion and ransomware are among the events a cyber policy may address, depending on its wording. That general description does not confirm that a ransom payment is covered. Check the specific provisions rather than treating the word “ransomware” as a promise to pay any demand. Separately, the Australian Signals Directorate’s guidance on cyber threats advises businesses affected by ransomware not to pay a ransom and to seek assistance. Paying does not guarantee recovery of files or prevent stolen information from being released. Insurance questions and the steps needed to respond to an attack both require attention.

Scams, Phishing and Cyber Fraud

Cover for social engineering, phishing-related financial losses and cyber fraud varies between policies. It may be included, available as an optional extension, subject to a separate sublimit or excluded. Check the provisions covering the particular loss.

Social Engineering and Supplier Payment Scams

Social engineering involves deception that persuades a person to take an action, such as transferring money or revealing information. Consider an illustrative supplier scam: a criminal sends a message that appears to come from your usual materials supplier and asks you to pay an invoice into a different bank account. You authorise the payment because you believe the request is genuine. Where provided, social engineering cover may respond to certain direct financial losses arising from this deception. Whether the transferred money is insured depends on the applicable provisions.

Phishing and Stolen Login Details

Phishing is a form of social engineering. Criminals use fraudulent emails, messages, websites or other communications to trick someone into sharing information, entering login details, opening a malicious link or making a payment. A contractor might receive a false request to sign in to a job management account. Where phishing-related losses are insured, the relevant provisions may concern cyber liability, social engineering or cyber fraud, depending on the wording. Check the provision for the specific loss. Clicking a phishing link, losing access to files and transferring money raise different questions about what the policy covers.

Cyber Fraud and Unauthorised Transfers

Depending on the wording, cyber fraud provisions may cover specified direct financial losses arising from fraudulent electronic activity. Depending on the policy, this may include a fraudulent instruction from a third party that causes a transfer without your knowledge or consent. That situation differs from a person being deceived into authorising a payment. The distinction matters when comparing the events described in the policy. When comparing options, ask about both scenarios: someone in your business approving a false payment request, and a criminal causing a transfer without your knowledge. The insurer’s definitions determine how it treats each situation.

Exclusions and Cover Limitations

Exclusions and limits vary between cyber policies. Some exclude bodily injury or physical property damage, circumstances known before cover began, deliberate or fraudulent acts by the insured, or systems outside the defined scope. Data restoration, hardware repair or replacement and system improvements are separate costs. A policy might address some of these expenses while excluding others. For example, restoring customer records and replacing a damaged laptop should be checked separately. Read the exclusions alongside the cover sections, limits, excesses and any endorsements before comparing quotes.

Cyber Cover and Other Insurance

Other business policies address different risks, although some provisions can overlap. Read the relevant documents together before assuming that one policy deals with every part of an incident.

Public Liability and Professional Indemnity

Public Liability Insurance concerns claims that negligent business activities caused a third party personal injury or property damage. Professional Indemnity Insurance concerns claims arising from professional advice or specialist services, including alleged negligence, errors or omissions. Some Professional Indemnity policies may include confidentiality or privacy breaches, while cyber incidents may be excluded unless specifically included or endorsed. A consultant facing a claim involving client information should therefore check the relevant wording for both products. The policy’s name alone does not confirm which incident, legal costs or financial losses it will cover.

Equipment Cover and Business Interruption

Electronic Equipment Breakdown addresses insured equipment and breakdown-type risks. General Property Insurance, also called Portable Equipment Insurance, concerns eligible portable business property affected by insured events. Neither description establishes cover for a cyber breach. Business Interruption within a Business Insurance Package also depends on its own insured-event requirements, commonly involving insured property damage. For a contractor, a damaged computer, lost access to digital records and interruption following a cyber attack therefore need separate attention. Check the event that triggers each section of cover and avoid assuming that a general reference to equipment or lost income includes cyber losses.

Different policies, different cover questions

Comparing Cyber Insurance Quotes

Compare the premium alongside the events, costs and losses each quote may cover. Check the selected options and exclusions before deciding whether two quotes offer comparable cover.

Price and the Cover Selected

Use a quote for your business to check the premium and the cover offered. Compare it alongside the policy documents, including the insured events, optional extensions, limits, excesses and exclusions. For example, a quote that includes an extension relevant to certain fraudulent transfers raises different questions from one that does not include that extension. Read both sets of documents before comparing their prices. If a term or omission is unclear, ask for an explanation so you understand the cover on offer.

Questions to Put to the Insurer

Ask which business systems and incidents fall within the cover, and which costs or losses the policy may respond to. Check whether provisions for social engineering, phishing-related losses or cyber fraud are included, optional, subject to sublimits or unavailable in that quote. Ask the insurer to explain the limits, sublimits and excesses, along with any security conditions, notification requirements or approvals for response costs. For a supplier payment scam, explain whether someone approved the transfer or it occurred without authorisation rather than asking only whether the policy “covers cybercrime”.

Prepare for a Cover Discussion

Bring details of how your business works so you can ask questions about the cover offered:

• List the systems, accounts and service providers used for work.
• Describe the customer, client and worker information you hold.
• Record how your business approves payments and bank detail changes.
• Gather current insurance documents and relevant client requirements.

Responding to a Cyber Incident

Follow your incident response plan, seek IT assistance and check your policy’s notification instructions. Depending on the incident, you may also need to contact your bank and assess data breach reporting obligations.

Contain the Incident and Seek Assistance

Use your incident response plan and contact your IT support provider. ASD’s cyber threat guidance advises disconnecting a device from the network and seeking IT assistance if you suspect malware. Contact your bank immediately if money has been lost or financial information compromised. Keep a record of what you observed and the actions taken. Before an incident, identify who will make decisions, contact service providers and handle communications. ASD’s incident response planning guidance recommends setting out responsibilities and procedures, keeping contact details current and testing the plan. A sole trader can use the same approach by recording the people they would need to call.

Check Your Policy’s Notification Instructions

If you hold cyber insurance, check the incident notification and claims instructions in your policy documents and contact the listed insurer or claims contact promptly. Ask what information they require and whether approval is needed before appointing a provider or committing to response costs. Keep relevant messages, records and receipts, and follow the instructions that apply to your policy. Do not wait for a customer to make a claim before checking whether incident response provisions may be relevant. Notifying the insurer does not confirm that the incident or each expense is covered; the wording and circumstances still determine the claim.

Check Data Breach Reporting Obligations

Notification duties depend on your business and the information involved. The Office of the Australian Information Commissioner (OAIC) explains that many small businesses are exempt from the Privacy Act, but exceptions apply. Some have duties relating to particular information, such as tax file numbers. If the Notifiable Data Breaches scheme applies, an eligible breach generally requires notification to individuals at risk of serious harm and the OAIC as soon as practicable, unless an exception applies. An eligible breach involves likely serious harm that remedial action has not prevented. Check the OAIC’s small business privacy guidance and data breach response guide, and seek advice about your obligations.

Ransomware payment reporting: Separate obligations apply to certain Australian businesses, including those with turnover of at least $3 million in the previous financial year and certain critical infrastructure entities. If a ransomware or cyber extortion payment is made, or is made on their behalf, qualifying entities generally must report it within 72 hours of making the payment or becoming aware of it. An unpaid demand does not trigger this payment reporting requirement. See the Australian Government’s ransomware payment reporting guidance.

Reducing Cyber Risk at Work

Use security measures alongside any insurance you arrange. ASD’s fundamental cyber security guidance recommends multi-factor authentication, strong unique passwords or passkeys, and prompt security updates. Multi-factor authentication adds another check when you sign in, such as entering a password and then a code from an authenticator app. For a contractor, start by reviewing the email and job management accounts used to send invoices and access customer records. Include anyone who helps with bookings or payments. Check that they know what to do with an unexpected request, especially a change to a supplier’s bank details. These steps support safer working practices. Insurers may also ask about security measures when assessing an application.

• Protect account access. Enable multi-factor authentication and avoid reusing passwords.
• Keep software updated. Apply security updates to the devices and applications used for work.
• Back up business information. Keep backups separate from your main systems and test recovery.
• Verify payment changes. Call the supplier on a known number, rather than a number supplied in a suspicious email.
• Prepare for an incident. Keep response contacts and responsibilities current, and test your plan.

Cyber Insurance FAQs

Check the wording against the way you use technology, including services managed by someone outside your business.

Can Cyber Insurance Be Relevant Without a Website?

Yes. Your use of business email, digital customer records, cloud software or electronic payments can make cyber cover relevant to consider even if you do not operate a website. For example, a sole trader might organise all work through an email account and keep client information on a laptop. The useful starting point is the information and systems used by the business. Having no website does not remove those considerations. Whether a policy is available or appropriate still depends on the business, the cover offered and insurer acceptance.

Does Using an IT Provider Remove the Need?

An IT provider’s role in managing your systems does not, by itself, establish which financial losses or third-party claims you have insured. Review the provider’s contract alongside your own insurance documents. For example, ask what assistance the provider would give after an incident, then check the policy for the costs and claims it may cover. Avoid assuming that a support agreement includes insurance for your business.

Are Cloud Software Outages Covered?

Some cyber policies cover business interruption involving third-party or cloud service providers. Cover may depend on whether the interruption results from a covered cyber incident, system failure or another specified event. Check the affected services, waiting period, indemnity period, limits and exclusions. An ordinary service outage is not automatically insured.

Which Documents Should I Read Before Buying?

Read the documents supplied with the quote that describe the selected cover, alongside the policy wording or Product Disclosure Statement and any documents changing its terms. Consider the Target Market Determination where applicable. Check that the descriptions of your business and selected options reflect what you provided and requested. For example, if you discussed losses arising from social engineering, check where and how those losses are addressed in the quote. Ask for clarification where documents appear inconsistent. A product description explains the general purpose of cover; the policy documents establish its terms.

Compare Cover for Your Contracting Business

Cyber insurance may help with your business’s costs and third-party claims after a covered cyber incident. Check the wording for recovery, interruption and any provisions relating to fraudulent transfers.

For Australian contractors, start with the systems, customer information and payment processes you use, then compare the cover offered against those exposures.

Explore contractor insurance with Contractor Cover or call 1300 438 268 for general information about available options.

General information only. This information does not take into account your objectives, financial situation or needs. Consider whether the information is appropriate for your circumstances, and read our Financial Services Guide, the relevant policy wording or Product Disclosure Statement and, where applicable, the Target Market Determination before deciding whether a product is right for you. Cover is subject to insurer acceptance and the relevant policy terms, conditions, limits and exclusions. Examples are illustrative and do not confirm a claim outcome.