Cyber exposure can be particularly important for Defence Contractors and Consultants because they may handle commercially sensitive or Defence-related information.

Cyber Insurance can provide financial protection against certain insured cyber incidents.

What can Cyber Insurance cover? #

Depending on the policy, cover can include:

• Incident response.
• Forensic investigation.
• Data restoration.
• Business interruption.
• Privacy liability.
• Cyber extortion.
• Notification costs.
• Legal expenses.
• Certain third-party claims.

The exact scope varies by insurer.

Does Cyber Insurance satisfy DISP requirements? #

No.

Insurance and Defence security compliance are separate issues.

Defence currently requires DISP members to achieve and maintain the full Essential Eight at Maturity Level 2 across relevant corporate ICT systems.

Having Cyber Insurance does not demonstrate compliance with that requirement.

Does Essential Eight compliance guarantee Cyber Insurance? #

No.

Insurers carry out their own underwriting assessment.

They may ask about controls such as:

• Multi-factor authentication.
• Application control.
• Patch management.
• Privileged access.
• Backups.
• Endpoint protection.
• Incident response.
• Staff training.

Strong security controls can assist underwriting but do not guarantee cover.

What information should be disclosed? #

The insurer may need to understand:

• Type of Defence information handled.
• Data storage arrangements.
• Cloud providers.
• Remote access.
• Subcontractor access.
• Security frameworks used.
• Previous cyber incidents.

Classified or sensitive information should be described appropriately without unnecessarily disclosing protected material to an insurer or broker.