CyberCare 2.0

Our Cyber insurance is specifically tailored to protect small businesses with essential coverage against cyber threats and data breaches. CyberCare 2.0 provides sophisticated yet affordable coverage to minimise the impact to your business and protect its reputation.

CyberCare 2.0 replaces CyberCare (cybercareau). The two products share the occupation list and the occupation_percentages, revenue_value, region_earnings_percentages, insured_website_url and claims parameters. CyberCare 2.0 adds risk control questions, excluded activities, optional cover upgrades and a wider range of aggregate limits. The bank_change_auth_procedure parameter is now one of the risk control questions, and australian_bookkeepers_network_member is no longer used.

Parameter Explanations

Note, all of the identifier values are prone to change, particularly the occupation identifiers. It is highly recommended that any UI built populates the select options dynamically using the product info.

Parameter	Type	Description
`product`	String	The product slug: “cyberau”
`name_of_insured`	String	The name of the business being covered
`name`	String	The name of the contact person at the insured business
`email`	String	The email address for the contact person at the insured business
`policy_start_date`	String	Optional, see Products page for more info
`policy_end_date`	String	Optional, same format as start date. The shortest length for a policy is 8 months, the longest is 18 months. Leave blank for the default duration of 12 months.
`occupation_percentages`	object: { occupation_identifier: number }	The percentages for each of the occupations the insured business undertakes. For each occupation selected, the identifier is used as a key for the object, with the value being the percentage. The sum of all the numbers must add up to 100.0. For example: `{"businessfinancialservices_accountantbookkeeping": 60, "businessfinancialservices_accountantaccountspreparation": 40}`
`revenue_value`	Integer	The revenue for last year, in AUD. Must be greater than 0.
`aggregate_limit`	String	The identifier for the selected `aggregate_limit` option. See Aggregate limits.
`region_earnings_percentages`	object: { state_code: number }	The percentages for each State the insured business earns revenue in. For each state selected, the lower case code is used as a key for the object, with the value being the percentage. The sum of all the numbers must add up to 100.0. For example: `{"nsw": 62, "vic": 38}`. The permitted keys for the object are `nsw`, `vic`, `qld`, `sa`, `wa`, `tas`, `nt`, `act` and `overseas`
`general_stamp_duty_exempt`	Boolean	Optional. Should only be `true` if the insured is exempt from stamp duty. When `true`, no stamp duty is charged in any State. Proof of this status may be required.
`insured_website_url`	String	The URL for the website of the business being insured. If there is no website, “N/A” is an acceptable string.
`claims`	String	The identifier for the selected `claims` option: `yes` or `no`. You must answer `yes` if the insured has had a claim in the last five years.
`claims_info`	String	Required if `yes` was selected for `claims`. Details about the claim or claims, to assist the underwriter in evaluating the quote.
`excluded_activities`	String	The identifier for the selected `excluded_activities` option: `yes` or `no`. See Excluded activities.
`excluded_activities_details`	String	Required if `yes` was selected for `excluded_activities`. An explanation of the excluded activities the insured is involved in.
`risk_control_questions_confirmations`	object: { question_identifier: Boolean }	The insured’s answer to each of the risk control questions. Each question identifier is a key, and the value is `true` if the insured answers “Yes”. Any question that is missing or not `true` is treated as “No”. See Risk control questions.
`risk_control_questions_details`	String	Required if any risk control question (other than `bank_change_auth_procedure`) is not answered `true`. An explanation of why the control is not in place.
`number_of_pii_records`	String	Required if `revenue_value` is more than $30,000,000. The identifier for the selected `number_of_pii_records` option, which is the number of records of personally identifiable information the insured holds. The options are `0_50000`, `50001_100000`, `100001_250000`, `250001_500000` and `500001_plus`.
`funds_transfer_fraud_upgrade`	String	Optional. The identifier for the selected `funds_transfer_fraud_upgrade` option: `yes` or `no`. See Optional cover upgrades.
`non_it_provider_dependent_bi_upgrade`	String	Optional. The identifier for the selected `non_it_provider_dependent_bi_upgrade` option: `yes` or `no`. See Optional cover upgrades.
`referral_request_details`	String	Optional. A free text request for an underwriter to review the quote. Any value at all will refer the quote.

Aggregate limits

The aggregate_limit options are:

Identifier	Limit
`aggregate_limit_250k`	$250,000
`aggregate_limit_500k`	$500,000
`aggregate_limit_1m`	$1,000,000
`aggregate_limit_2m`	$2,000,000
`aggregate_limit_3m`	$3,000,000
`aggregate_limit_5m`	$5,000,000
`aggregate_limit_6m`	$6,000,000
`aggregate_limit_7m`	$7,000,000
`aggregate_limit_7_5m`	$7,500,000
`aggregate_limit_8m`	$8,000,000
`aggregate_limit_9m`	$9,000,000
`aggregate_limit_10m`	$10,000,000
`aggregate_limit_more_than_10m`	More than $10,000,000

The data attribute of each option includes trigger_referral_if where a limit only refers below a certain revenue.

Excluded activities

The following must be presented to the insured so they may answer “No” (no) or “Yes” (yes). The list of examples is also returned in the product info, in the product settings excluded_activities_examples.

Do your business activities, including that of your Subsidiaries involve any of the following:

Abortion clinics

Adult entertainment

Adult services (escort services, prostitution)

Crypto assets

Gambling

Games development

Information technology hosting services

Multiple ticketing platforms

Nuclear or similar power utilities

Online dating services

Paramilitary organisations

Payment Processor

Real time trading systems

Social media platform

Software as a service (SaaS)

Risk control questions

Each question must be presented to the insured. Use the identifier as the key in risk_control_questions_confirmations, with true for “Yes”. The questions are also returned in the product info under risk_control_questions.

Identifier	Question
`privacy_policy`	Do you have a privacy policy in place governing your collection and handling of private data and/or Personal Information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth)?
`anti_malware`	Do you have anti-malware software installed, enabled and updated at least daily on all endpoint devices, including desktops, laptops and servers, but excluding database servers?
`patch_management`	Do you, or your outsourced IT service provider, have a patch management policy in place that requires critical patches to be implemented within 30 days?
`firewall`	Do you have firewalls installed on all external gateways, with automatic system updates enabled and active?
`backup`	Do you or your cloud hosting provider back up your critical data at least once per month and store those backups in a location that is separate from your physical premises and segregated from your network?
`backup_recovery_tested`	Have you tested your backup recovery process, and can you recover all business-critical data and systems within ten (10) days?
`mfa`	Have you implemented multi-factor authentication (MFA) for all users with remote access to the Computer Network, including access through Remote Desktop Protocol and Office 365?
`bank_change_auth_procedure`	Do you have a written policy or procedure requiring all written requests to change bank account details to be authenticated by calling the requesting individual or entity using a telephone number already held on file?

Answering “No” to any question other than bank_change_auth_procedure refers the quote, and risk_control_questions_details becomes required.

Answering “No” to bank_change_auth_procedure does not refer the quote. Instead it removes the Funds Transfer Fraud cover.

Optional cover upgrades

funds_transfer_fraud_upgrade

The standard Funds Transfer Fraud sub-limit is $100,000. Selecting yes increases it to $250,000 for an additional premium of $500. This upgrade refers the quote.

non_it_provider_dependent_bi_upgrade

The standard Non-IT Provider Dependent Business Interruption sub-limit is $250,000. Selecting yes increases it to $500,000, with a 5% loading on the premium.

Minimum Parameters to get a quote

{
  "product": "cyberau",
  "occupation_percentages": {
    "businessfinancialservices_accountantbookkeeping": 100
  },
  "aggregate_limit": "aggregate_limit_1m",
  "revenue_value": 1250000,
  "region_earnings_percentages": {
    "vic": 100
  },
  "insured_website_url": "https://example.com",
  "claims": "no",
  "excluded_activities": "no",
  "risk_control_questions_confirmations": {
    "privacy_policy": true,
    "anti_malware": true,
    "patch_management": true,
    "firewall": true,
    "backup": true,
    "backup_recovery_tested": true,
    "mfa": true,
    "bank_change_auth_procedure": true
  }
}

All Parameters

{
  "product": "cyberau",
  "name_of_insured": "My Business Pty Ltd",
  "name": "Mary Smith",
  "email": "marysmith@example.com",
  "policy_start_date": "2026-12-01",
  "policy_end_date": "2027-12-01",
  "occupation_percentages": {
    "businessfinancialservices_accountantbookkeeping": 60,
    "businessfinancialservices_accountantaccountspreparation": 40
  },
  "aggregate_limit": "aggregate_limit_2m",
  "revenue_value": 32000000,
  "region_earnings_percentages": {
    "vic": 70,
    "nsw": 30
  },
  "general_stamp_duty_exempt": false,
  "insured_website_url": "https://example.com",
  "claims": "yes",
  "claims_info": "A ransomware incident in 2024 was resolved with no data loss",
  "excluded_activities": "yes",
  "excluded_activities_details": "Provides a small payroll SaaS tool to existing clients",
  "risk_control_questions_confirmations": {
    "privacy_policy": true,
    "anti_malware": true,
    "patch_management": true,
    "firewall": true,
    "backup": true,
    "backup_recovery_tested": false,
    "mfa": true,
    "bank_change_auth_procedure": true
  },
  "risk_control_questions_details": "Backup recovery testing is scheduled for next month",
  "number_of_pii_records": "100001_250000",
  "funds_transfer_fraud_upgrade": "yes",
  "non_it_provider_dependent_bi_upgrade": "yes",
  "referral_request_details": "Please review the higher Funds Transfer Fraud sub-limit"
}