If you’ve applied for cyber insurance recently and found the questionnaire confusing, you’re not alone. Most small business owners have never heard of the “Essential 8” — but in 2026, it’s become the baseline insurers use to decide whether to cover you, and at what price.
What is the Essential 8?
The Essential 8 is a set of security controls from the Australian Signals Directorate (ASD). It isn’t law for private businesses, but it’s become the de facto standard insurers, and increasingly supply-chain partners, check for before extending cover or signing a contract.
The three things insurers check first, every time
- Multi-factor authentication (MFA) on email, remote access, and admin accounts. No serious insurer issues cover without it anymore — this is the single most common reason an application gets knocked back.
- Backups that can’t be deleted or encrypted by ransomware (“immutable” backups). If your only backup can be wiped by the same attack that hits your live system, insurers treat that as no backup at all.
- Patching — how quickly you close known security holes, especially on anything internet-facing.
What “good enough” looks like in 2026
For most small and medium businesses, Maturity Level 2 is the realistic target — it’s what satisfies most insurance questionnaires and, for local logistics and warehouse operators, what supply-chain partners are starting to ask for directly following the Western Sydney Airport cargo hub opening.
You don’t need to rebuild everything
The good news: none of this requires ripping out your existing systems. It’s a gap analysis, then a prioritised fix list — usually a handful of specific, well-understood changes, not a full IT overhaul.
Our free 2-minute Easy-Check gives you a plain-English starting point — no sales pitch, just where you actually stand. Take the Easy-Check to see your score.