Cyber insurers are no longer just asking if you have backups

For years, cyber insurance applications asked a simple question: do you have backups? That checkbox is no longer sufficient.

What insurers want now

Underwriters are increasingly asking follow-up questions that mirror Essential Eight Practice 11 (daily backups) and Practice 12 (incident response):

When did you last test a restore, not just create a backup?
What is your documented recovery time objective, and can you demonstrate it?
Are backups isolated from production networks?
Who is accountable when restoration fails during an incident?

Organisations that cannot answer these questions with evidence face higher premiums, coverage exclusions, or outright declinatures.

The Essential Eight connection

Insurers are not formally mandating Essential Eight maturity, but the questions they ask map directly to strategies 10, 11, and 12. Demonstrating ML2 or above in these areas strengthens your position at renewal.

What to prepare before renewal

Export your latest maturity assessment with backup and recovery strategies highlighted
Gather restore test logs from the past 12 months
Document who owns backup validation and how often it occurs
Align your incident response plan with backup recovery procedures