Cyber insurance cover for New Zealand businesses

For businesses assessing cyber insurance IT security requirements in NZ, the key rule is straightforward: cyber insurance is not mandatory in New Zealand. It may still form part of a practical risk management strategy, particularly if your organisation relies on technology or holds information online.

A cyber incident can disrupt your operations and create costs or liabilities involving other people. Understanding first-party cover, for losses your business suffers, and third-party cover, for losses you may be legally liable for, is therefore just as important as knowing whether a policy is required.

This article explains what cyber insurance may cover, how policy wording defines that cover, and how insurance fits alongside practical steps to protect people, information and business assets. It also outlines what to consider when assessing your organisation’s needs, so you can make an informed decision.

What is cybersecurity insurance?

Cyber insurance covers certain financial losses linked to cyber incidents. For New Zealand businesses, this may include response costs, business interruption and IT restoration, depending on the policy wording.

Business interruption cover may help with lost income or extra operating expenses when an incident disrupts normal work. IT restoration cover may contribute to recovering affected systems, applications and data. Check how the policy defines a covered incident, which costs are included, and what limits or exclusions apply. For example, a business may be unable to process orders while restoring its systems after an attack.

Businesses and systems that may benefit

Businesses that handle customer data, store business information online or rely on technology for daily operations have reasons to assess cyber cover. The Ministry of Business, Innovation and Employment says small and medium-sized enterprises make up 97% of New Zealand businesses, while one in two cyber events in New Zealand target small and medium-sized enterprises.

Start by identifying business-critical systems: the systems and applications your organisation needs for normal operations, whether internal or external. Externally facing systems sit outside an organisation’s authorisation boundary and either meet the business-critical definition or connect to a business-critical system. List the systems that support essential work such as sales, payments and customer communications.

Insurer security requirements

How do cyber insurance security requirements differ between NZ insurers? Requirements vary by insurer and policy, so compare the policy wording and application questions rather than assuming one standard applies. Questions may cover safeguards such as backups, recovery planning, staff training and phishing controls.

Do NZ cyber insurance policies require regular backups and tested recovery plans? Are staff security training and phishing controls required for NZ cyber cover? It depends on the specific policy conditions. Before applying, document your backup schedule, recovery tests, staff training and email protections, then compare them with the insurer’s stated requirements.

CERT’s 11 cyber security tips offer New Zealand businesses practical steps for reducing cyber risks. Use them to review your current practices, then record who owns each action and how it is maintained.

Claims, privacy rules and policy costs

Can a NZ cyber insurance claim be denied for failing to meet security requirements? A claim may be affected if the business has not met a relevant policy condition or has provided inaccurate information. Keep evidence of your controls and follow the policy’s claims process, including its notification steps.

What NZ privacy breach notification rules affect cyber insurance claims? Insurance wording does not replace privacy responsibilities. For a suspected breach, record what happened, notify the insurer as required by the policy, and follow the applicable New Zealand notification process.

What are typical cyber insurance premiums and coverage limits in New Zealand? Premiums and limits depend on the cover selected, the business’s risk profile and the policy terms. Compare interruption, restoration and response cover with the systems your organisation relies on, and read the wording before deciding.

Whether cyber insurance is mandatory in New Zealand

Cyber insurance is not mandatory in New Zealand. Businesses can decide whether it suits their risk management needs by considering their use of technology, the information they hold and their ability to manage disruption.

Insurance status and financial exposure

Direct financial losses from cyber incidents reported to CERT reached NZ$3 million in the first quarter of 2021.

These figures help explain why organisations assess potential exposure, but they do not determine whether insurance suits a particular business. Consider the potential cost of interrupted operations, system restoration and incident response. The New Zealand Security Intelligence Service has assessed New Zealand’s security threat environment, which businesses can consider alongside their own operational risks.

Requirements for small businesses

Small businesses considering cover should read the application questions and policy conditions carefully. Requirements vary between insurers and policies, so there is no single set of controls that applies to every New Zealand business.

Are MFA and endpoint detection required for cyber insurance in NZ? Insurer applications or policy terms may address these controls, but requirements vary. What vulnerability scanning and patching standards do New Zealand cyber insurers expect? Check the insurer’s stated conditions rather than assuming one standard applies across the market.

Do NZ cyber insurance applications require disclosure of security incidents or ransomware controls? Answer application questions accurately, including those about previous incidents and current safeguards. The application wording specifies what information the insurer requests.

What cybersecurity requirements apply to small businesses seeking cyber insurance in New Zealand? Insurers set requirements in their own terms, so business size alone does not establish a universal checklist. Identify key systems, document existing safeguards and compare them with the policy conditions.

What steps should a New Zealand business take to qualify for cyber insurance? Start by reviewing the insurer’s application and policy wording. Record your security controls, note any gaps against the stated requirements, and prepare accurate answers about your systems and incident history.

Government security guidance is separate from insurance. The New Zealand Information Security Manual (NZISM) is relevant context for public agencies. New Zealand’s Minimum Cyber Security Standards apply to business-critical and externally facing systems, where applicable, for GCISO-mandated agencies. Non-mandated agencies are also welcome to adopt the standards.

For small businesses, the practical question is whether cover complements existing risk management. Compare the policy conditions with how your organisation operates, then consider whether the protection matches the disruption and response costs you could face.

Cyber insurance cover for first- and third-party losses

Cyber insurance can address two broad types of loss: direct harm to your business and claims from others for which your business may be legally liable. This distinction helps you assess what a policy might cover after an incident, rather than treating every cyber-related cost as the same.

First-party losses are direct effects on the insured business. A cyber incident could disrupt operations, require specialist response support or damage information your organisation relies on. The policy wording determines which losses and response costs are covered, how they are assessed, and what limits or exclusions apply.

Consider a business whose online ordering system becomes unavailable after an incident. It may face direct costs while responding and restoring operations. Whether those costs qualify for cover depends on the policy’s definitions, the cause of the disruption and any conditions the business must meet. Compare these details with the systems your organisation relies on.

Third-party losses arise when another person or organisation brings a claim against your business. For example, a customer might allege that a cyber incident involving their information caused them harm. Cyber insurance may cover third-party losses for which the insured is legally liable, but the policy sets the boundaries of that cover.

Some policies also provide access to a retained response team, with IT, legal and public relations professionals on standby. If an incident involves customer information, these specialists may help coordinate the technical response, legal advice and communications. Check whether the policy includes this support, how to access the team and which services are covered.

Pay particular attention to extortion cover. According to Marsh, some cyber insurance policies cover ransom payments, while others specifically exclude them. Read the relevant policy wording carefully, including any conditions for extortion events. A broad description of cyber cover does not mean every ransom-related cost is included.

Marsh also says cyber insurance may help cover legal fees if a business is fined for failing to report a data breach properly. This does not mean every fine or legal expense is covered. Review the wording for the circumstances it addresses, and understand how notification requirements and policy conditions relate to a claim.

To compare cover, match each policy section to a realistic scenario: direct disruption to your business, a customer claim or an extortion event. Then check the exclusions, limits, response services and notification conditions. Cover varies by insurer and is set out in the policy wording, so this comparison helps show where protection differs.

Protection of people, information, and assets

Cyber insurance is one part of managing cyber risk. New Zealand’s Protective Security Requirements (PSR) outline what government entities must do to protect people, information and assets. The framework can help organise a business risk review, but its government requirements should not be assumed to apply to every private organisation.

Start with people. Identify who needs to know how to report a suspicious email, unusual account activity or lost device. A simple reporting route, for example, helps staff raise concerns early so the right people can assess them. Record who coordinates internal updates and who communicates with customers or suppliers.

Next, identify the information your organisation holds and where it is used. New Zealand’s Government Security Classification System provides a basis for classifying and protectively marking information. A business can apply the practical idea by listing information types, such as customer records, payroll details and supplier contracts, then deciding who needs access and how each type should be handled.

Classification helps clarify decisions about access, storage and sharing. A customer contact list, for example, may need different handling from a public product brochure. Note where sensitive information is stored, which teams use it and what business processes depend on it. This record can help you understand the impact of a cyber incident and prepare useful information for an insurance application or claim.

Assets include the systems, devices and facilities that support your work. Inventory key technology and its business purpose, such as the system used to take orders or the devices staff use to access records. Link each asset to a responsible person and identify the information it stores or processes. This makes it easier to see how an affected system could influence people, information and operations.

A focused review can follow these steps:

• Identify people: note staff roles that handle sensitive information or coordinate incident response.
• Map information: record important information types, storage locations and access needs.
• List assets: connect devices, applications and facilities to the business activities they support.
• Review dependencies: consider what staff and customers would experience if an important system became unavailable.

Use the results to review risk priorities and insurance wording. A clear view of people, information and assets helps you assess whether policy cover aligns with the disruption your organisation needs to manage. It also connects security planning more closely to everyday business operations.

Keeping people, information and assets in view grounds a risk review in your organisation’s exposure. Marsh says businesses that handle customer data, store business information online or have a significant online presence should especially consider cyber insurance. These are useful prompts when deciding whether to explore cover, alongside an assessment of which information and systems matter most.

New Zealand’s Protective Security Requirements provide guidance on obtaining and maintaining a national security clearance. That guidance is distinct from using the framework to organise a business risk review; it does not mean clearance requirements apply to every private organisation. Focus the review on risks and responsibilities relevant to your organisation, then use the findings to inform an insurance discussion.

What IT security controls do cyber insurers in New Zealand require?

There is no single security checklist shared by every cyber insurer in New Zealand. Insurers set their own application questions and policy conditions, so assess your controls against the wording for the cover you are considering.

Start by documenting how your organisation manages access, devices, updates, backups and staff security awareness. Note how access is granted and removed, how security updates are applied, and who checks that backups can be restored. These records help you describe your current practices accurately in an application.

Insurer questions may cover multi-factor authentication, endpoint protection, vulnerability management, staff training and recovery planning. Treat these as areas to review, not a universal list of mandatory controls. If an application asks whether a control applies across your organisation, answer based on its actual scope.

Review the IT security requirements insurers set for cyber insurance in New Zealand before completing an application. Check that your written answers reflect how systems are managed day to day. If you state that a control is in place, keep relevant evidence, such as access procedures, update records or recovery-test notes. If it applies only to some systems, describe that boundary clearly.

New Zealand’s Minimum Cyber Security Standards provide a separate reference point. GCISO-mandated agencies are required to implement them, while non-mandated agencies are welcome to adopt them. Where applicable, the standards cover business-critical and externally facing systems.

The standards use four levels of the PSR Capability Maturity Model, which has five levels. According to the National Cyber Security Centre, they align with the five functions of its Cyber Security Framework. These government standards are not a universal insurer checklist for every business. Their relevance depends on the organisation and its obligations.

For a practical review, group your controls by purpose:

• Manage access: review account permissions and authentication for important systems.
• Maintain systems: record how updates and vulnerabilities are managed.
• Support recovery: document backup arrangements and recovery testing.
• Prepare people: make staff guidance and incident reporting steps easy to find.

Compare your evidence with each insurer’s questions, definitions and exclusions. Map requirements to the relevant systems, then identify practical improvements. This clarifies which cyber insurance security requirements your organisation needs to address and what the policy expects.

No single vulnerability-scanning or patching standard applies across every cyber insurer in New Zealand. Insurers may ask how you manage vulnerabilities and security updates, so document your practices and compare them with each insurer’s specific questions and policy conditions.

The New Zealand government recommends that businesses consider cyber insurance as part of their overall risk management strategy. Businesses are also advised to read and understand a cyber insurance policy’s wording before buying.

In New Zealand, business-critical systems are systems and applications that must function for an organisation to conduct normal business operations, including internal and external systems. New Zealand businesses can report confirmed or suspected cyber incidents to CERT.

IT Works: Managed IT Services

Based in Wellington, IT Works helps New Zealand organisations connect day-to-day technology management with cybersecurity priorities. Its Managed IT Services and Cyber Security support businesses reviewing access controls, system maintenance, backup arrangements and incident readiness.

This support can help when your team needs to understand how existing controls align with an insurer’s application or wants a clearer view of technology risks across the organisation. The approach is practical: identify important systems, understand how they support business operations and plan improvements that strengthen resilience.

For organisations also considering cloud platforms or AI & Automation, IT Works can help align those decisions with broader technology and security needs.

Contact IT Works to discuss your cybersecurity priorities or visit itworks.co.nz.

Build security into your next business decision

As your organisation adopts new systems, changes how staff work or relies on new suppliers, its technology risks may shift. Build security into those decisions early. This gives leaders a clearer basis for setting priorities and keeping safeguards aligned with business needs.

Include cyber insurance IT security requirements in NZ in your planning. Keep security connected to operational decisions rather than treating insurance as a separate task. IT Works can bring Cyber Security, Managed IT Services and AI & Automation together in a considered technology strategy.

A steady, practical approach helps your organisation make informed decisions and move forward with confidence.

Frequently Asked Questions

What NZ privacy breach notification rules affect cyber insurance claims?

Insurance wording does not replace privacy responsibilities. For a suspected breach, record what happened, notify the insurer as required by the policy, and follow the applicable New Zealand notification process.

What are typical cyber insurance premiums and coverage limits in New Zealand?

Premiums and coverage limits depend on the cover selected, the business’s risk profile and the policy terms. Compare interruption, restoration and response cover with the systems your organisation relies on.