Cyber Insurance Is Getting Harder to Get

A cyber insurance assessment reviews your business’s security controls against what NZ insurers require before they’ll underwrite or renew a policy. NSP’s assessment identifies gaps that could affect your eligibility for coverage or your ability to make a successful claim and produces the documentation that supports your application.

NZ insurers consistently check for multi-factor authentication on critical systems, a documented patching schedule with evidence of compliance, tested backups with offline or immutable copies, endpoint and email security controls, VPN with MFA for remote access, staff phishing training records, and an incident response plan that has been tested. Requirements vary between insurers but these controls appear across most NZ proposal forms.

Most denials come down to controls that were stated in the application not actually being in place when the incident occurred or policies not being actively maintained throughout the coverage period. Insurers have voided policies where application answers about MFA or patching were inaccurate, even when the breach wasn’t directly related to those controls. NSP’s assessment and documentation service is specifically designed to prevent this scenario.

Not always but it significantly improves your chances of being accepted and reduces the risk of a claim being denied later. An assessment verifies your controls are actually in place and produces documentation that supports your application answers. Without it, you’re relying on your own judgement about controls that insurers will scrutinise carefully.

Yes. NSP provides application support – helping you understand what each question is actually asking, prepare accurate and defensible answers, and avoid the mistakes that lead to declined applications or voided policies. We work alongside your broker to give them the technical foundation they need to present a strong submission to underwriters.

A standard cyber security assessment looks at your overall risk exposure across all areas. A cyber insurance assessment is specifically scoped to what NZ underwriters are currently checking for – it maps your controls to insurer requirements, identifies what affects your insurability, and produces documentation in a format that supports your application and any future claim.

NSP is a cybersecurity provider, not a broker or insurer. We work alongside your broker to provide the technical verification they can’t do themselves – confirming your controls are actually in place, documenting the evidence, and fixing the gaps before they affect your coverage. Our NZ-based team has direct knowledge of what local underwriters are asking for, and we can refer you to our vCISO service if your assessment reveals broader security leadership gaps.

The application itself can be submitted in a day, but the preparation time depends on where your controls currently sit. If your MFA, backups, patching, and documentation are already in order, the process is straightforward. If there are gaps to close first, the realistic timeline is four to eight weeks. NSP’s readiness assessment at the start of the process gives you a clear picture of what is needed and how long it will take.

Incorrect answers on a cyber insurance application can void your policy at claim time, even if the incident was not directly related to the inaccurate answer. NZ insurers have declined claims where MFA or patching questions were answered based on partial deployment or intent rather than actual implementation. NSP’s application support is specifically designed to prevent this – we verify your controls before you answer.

Business interruption insurance covers loss of income when your business cannot operate. Cyber insurance covers the costs specific to a cyber incident – forensic investigation, regulatory notification, legal liability, ransomware response, data recovery, and reputational damage management. Standard business interruption policies typically exclude cyber incidents unless a specific cyber extension has been added. The two types of coverage serve different purposes and most NZ businesses that face meaningful cyber risk need both.

At a minimum, at renewal but ideally every six months or whenever there is a significant change to your environment. New systems, new staff, a cloud migration, or a change in how you handle personal data can all affect your coverage position. NSP’s periodic assessment service is designed to keep your posture current between renewals so there are no surprises when your insurer asks questions.

Yes and smaller businesses are often more exposed than they realise. The average cost of a data breach for a NZ SME includes incident response, regulatory notification under the Privacy Act 2020, downtime, and reputational damage. Cyber insurance does not prevent incidents, but it significantly reduces the financial impact when one occurs. NSP can help you assess whether your current risk profile justifies the investment and what coverage level makes sense for your business.

No – the roles are different. Your broker manages the insurer relationship, selects the right policy, negotiates terms, and advises on coverage. NSP provides the technical layer: assessing whether your controls actually meet insurer requirements, helping you close gaps before you apply, and preparing the documentation that supports your answers. Brokers who refer clients to NSP for pre-application assessments submit stronger applications and have fewer claim complications. NSP and your broker work together – they do not compete.