The cyber insurance renewal lands in your inbox. The questionnaire asks whether multi-factor authentication is enforced on every account, whether backups are tested and whether staff are trained. Someone in the business ticks yes to each one. Then it comes to you to sign.
A few weeks later, your board or your fellow owners ask the question that really matters: are we covered?
Most leaders can answer that question with confidence. Far fewer can answer it with evidence.
Why the calendar year-end, not 30 June
In Australia, budgets and hardware belong to the financial year. By the time July comes around, the laptops, licences and spending plans have been settled.
The end of the calendar year is a different moment. The business slows down, the Christmas shutdown is close, and leaders get a rare chance to step back before January planning starts. It’s the right time for a different kind of review: not what to buy, but what you can stand behind.
Most businesses don’t need more tools. They need a few fundamentals done properly, and evidence that they are.
So the review I’d run before the year closes is short. Three questions, each answered by the leader who has to stand behind the answer, and each backed by something more than a verbal assurance.
1. Can you prove your security controls?
Cyber risk is business risk. We see this every week as clients work through insurance renewals and supplier security questionnaires: the people assessing your risk want to see how security is managed, not just hear that it is.
That changes what a “yes” means. A ticked box on an insurance questionnaire is a statement your business is making. If it turns out not to be true when you need to make a claim, the problem is no longer technical.
Frameworks help because they turn controls into something you can show. SMB1001, the cybersecurity certification standard published by Dynamic Standards International (DSI), has five levels that progressively increase in maturity, so a business can start where it is and build from there. The Australian Signals Directorate’s Essential Eight is the other reference point most Australian leaders will hear about.
Whichever framework you use, the evidence looks much the same:
- Multi-factor authentication: a report showing it is enforced on every account, including administrator accounts and remote access, not just “turned on”.
- Patching: when systems were last updated, and what was deliberately left out and why.
- Access: who holds administrator rights today, and when that list was last reviewed.
- Training: who completed security awareness training this year.
If the person who signs the questionnaire can’t put their hands on that evidence, the answer is a belief, not a fact. If you want to see what a structured path to evidence looks like, here is how SMB1001 certification works.
2. How fast could you recover, and have you tested it?
Most businesses have backups. Far fewer know how long it would take to get their people working again from them.
We took on a client that had lost a week of data with their previous provider. The impact on the business was huge. They had a full week of data entry to redo, whilst trying to keep on top of the same week’s workload.
That is what a recovery failure usually looks like. Not a headline. A team doing the same week’s work twice.
A backup is a copy of your data. Recovery is your people working again. The difference only shows up when you need it, which is why it is worth testing before you do.
The Australian Signals Directorate makes the same point. Its Essential Eight Maturity Model expects that “restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises”.
Tested, not assumed.
Before the Christmas shutdown, ask:
- Time: if your main system were unavailable tomorrow, how long until your team could work again?
- Coverage: what is covered and what isn’t? Email and documents, but also the line-of-business systems and cloud services your people rely on every day.
- Proof: when was a restore last tested, and who saw the result?
3. Who governs your AI?
For most leadership teams, the question is no longer whether to use AI. It is who decides how it’s used, what it can access and how you will know it is working.
The Australian Government’s National AI Centre puts accountability first. Its Guidance for AI Adoption sets out six essential practices, starting with “decide who is accountable”. The others are understanding impacts and planning accordingly, measuring and managing risks, sharing essential information, testing and monitoring, and maintaining human control.
You don’t need a large program to make a start. You need clear answers on three things:
- Ownership: who in the leadership team is accountable for how AI is used.
- Access: what information AI tools can reach, and whether your permissions are tidy enough to trust that. AI won’t fix messy data. It exposes it.
- Approved tools: which tools staff may use with client or business information, and which they may not.
Then choose a small number of workflows worth improving, measure where you start, and scale what works. If you’re weighing up where to begin, start with getting AI-ready before rolling anything out widely.
Turning answers into evidence
Work through those three questions honestly and most leadership teams find a mix. Some answers they can prove. Some they believe. A few nobody owns.
That’s normal. The value is in knowing which is which before an insurer, a client or an incident asks you.
Essential Tech is ISO 27001:2022 certified and an SMB1001 Partner, so we hold ourselves to the same standard we ask of our clients. If you’d like an independent view before the year closes, book a Cyber & Compliance Maturity Assessment. We’ll measure where you stand against SMB1001 and give you the gaps in priority order, with a plan your leadership team can sign off.
Before the year closes, make sure the answers you’d give your board are ones you can prove.
My team and I would welcome the conversation.
Frequently asked questions
What should a year-end technology review cover?
Three things a leader should be able to answer with evidence: whether your security controls can be proven to an insurer or client, how quickly you could recover from an outage and when that was last tested, and who is accountable for how AI is used in your business.
Is SMB1001 the same as the Essential Eight?
No. SMB1001 is a cybersecurity certification standard published by Dynamic Standards International, with five levels. The Essential Eight is a set of mitigation strategies from the Australian Signals Directorate, with its own maturity model. Many businesses use both.
How often should we test restoring from backup?
ASD’s maturity model describes restore testing as part of disaster recovery exercises. At a minimum, test after any major change to your systems. If nobody can remember the last test, that is your answer.
This article is general information, not legal or insurance advice. Speak to your legal adviser or insurance broker about your business’s specific obligations and cover.
