General FAQs

It depends on your revenue, data, and how much downtime would hurt. That said, there are some common patterns Australian businesses use as a starting point. A common real world example and typical limits: Example: A growing SaaS business with 10 to 50 staff, Uses Google Workspace or Microsoft 365, Hosts on AWS, Azure or GCP, Stores customer personal information, Needs insurance to satisfy enterprise procurement. Common incident: A phishing email compromises an admin account. Attackers access customer data and deploy ransomware. The business needs urgent forensic support, legal advice, customer notification, and system recovery. There may also be an OAIC privacy complaint or investigation. In this type of scenario, it is common to see businesses choose a $2m to $5m cyber and technology limit as a starting point, depending on: How many customer records are involved, How long the business could be down, Whether contracts require a minimum cyber limit, Whether the business has US exposure, payment data, or health data. This aligns with the reality that breach response costs, extortion response, and business interruption can add up quickly, and policies can include cover for areas like breach response, cyber extortion expenses, and business interruption, subject to waiting periods and policy terms.