Insurance isn’t short on cyber frameworks. It’s short on enforceability. There is a growing need to address cybersecurity for insurance in today’s digital age.
What trips leadership teams up is not the absence of policies or tools. It’s the gap between what the organisation believes is covered and what can be evidenced when APRA, auditors, incident responders, or insurers ask hard questions.
In APRA-regulated insurance, “we thought the vendor handled that” is not a defence. Nor is “we have a policy”. The defensible position is much narrower: you can show who owned the decision, what evidence you relied on, and what you did when evidence was missing.
This article lays out a practical model for insurance leadership teams: treat cyber risk as a set of gated decisions across the lifecycle, make vendor obligations enforceable, and maintain an evidence pack that stands up under scrutiny. The Six Security Gates approach referenced here is drawn from Cliffside’s Cyber‑Ready Board material.
Why this is getting harder, not easier
Attackers keep choosing the boring path: suppliers, credentials, and exposed edge systems.
Verizon’s 2025 DBIR findings are blunt: third‑party involvement in breaches doubled to 30%, and vulnerability exploitation rose 34%; credential abuse and vulnerability exploitation remained leading initial access methods. That is exactly the mix insurers should expect: ecosystems built on vendors, brokers, TPAs, SaaS, outsourced claims and contact centres—plus a lot of sensitive personal data.
Australian breach reporting tells a similar story at the “what actually happens” level. In the OAIC’s July–December 2024 reporting period, Australia recorded 595 Notifiable Data Breaches (NDB) notifications (and 1,113 total NDB notifications for 2024). In that same six‑month period, Finance (incl. superannuation) was a top‑five sector with 54 notifications (9%). Even if you’re not personally accountable for every incident, you are accountable for whether your organisation’s decisions were defensible.
Finally, the ACSC’s latest Annual Cyber Threat Report shows the scale and cost pressure leaders are operating under: 84,700 cybercrime reports in FY2024–25 (about one every 6 minutes) and an average self‑reported business loss of $80,850 per report.
The APRA reality: accountability does not outsource
APRA’s direction under CPS 234 is clear: the board is ultimately responsible for ensuring the entity maintains information security, including for assets managed by related parties and third parties.
CPS 234 is also explicit about what “defensible” means in practice:
An APRA‑regulated entity must classify information assets (including those managed by third parties) in a way that reflects potential impact to the entity and to policyholders and other customers. It must implement controls that are commensurate with threats and the stage in the asset lifecycle (planning and design through to decommissioning).
It must run systematic testing and assurance, and internal audit must review design and operating effectiveness of information security controls, including those maintained by third parties. It must have incident response plans that are reviewed and tested at least annually. And if a material information security incident occurs, CPS 234 requires the entity to notify APRA as soon as possible and no later than 72 hours after becoming aware (plus a 10 business day notification requirement for certain material control weaknesses that cannot be remediated in a timely manner).
Here’s the uncomfortable implication leaders often miss: when pressure is on, you do not rise to your policies—you fall to your operating model. If your operating model allows material initiatives to reach go‑live without evidence, then you have engineered “risk by default”.
Separately, APRA’s CPS 230 operational risk program is designed to strengthen management of operational risk, respond to disruptions, and manage risk from service providers across APRA‑regulated entities. APRA’s published timeline sets the effective date at 1 July 2025, with transitional arrangements for some pre‑existing service provider contracts to apply until 1 July 2026 (or earlier on renewal). If you’re treating vendor governance as a “procurement checkbox”, you are behind the regulatory and insurer expectation curve.
In APRA‑regulated insurance, “we have a policy” isn’t evidence. Defensibility is ownership, proof, and time‑bound decisions.
The model that fixes this: Six Security Gates applied to insurance
Most risk is accepted quietly during planning and delivery, then leaders try to retrofit controls when BAU is already exposed. The gates model stops that by forcing decisions earlier, when you still have leverage.
The six gates are:
- RFP and selection (you stop buying risk)
- Vendor solution context (you stop assuming brand = control)
- Contractual obligations (you buy leverage)
- Design and integration (you stop baking in insecure access paths)
- Pre go‑live (you stop approving “we’ll fix it later”)
- BAU handover (you stop operationalising ambiguity)
This maps cleanly to CPS 234’s lifecycle requirement (controls commensurate with the stage in the lifecycle) and its explicit third‑party expectations.
If evidence is missing, the risk is already being accepted. The only question is whether it’s explicit and defensible.
What “enforceable vendor security” actually means in insurance
Vendor questionnaires do not create leverage. Contract terms do.
At the Contractual Obligations gate, enforceability means your contracts contain measurable obligations and practical rights that work when things go wrong:
Security obligations are measurable (not “industry standard”). Remediation SLAs exist, with reporting cadence. Incident notification timelines and cooperation requirements are explicit. Audit and assurance rights are real (including the right to validate evidence where appropriate). Data handling is explicit: residency, access paths, subcontractors, retention, secure deletion, and exit support.
Why be this hard‑line? Because the breach patterns insurers see are predictable. In Verizon’s Financial & Insurance vertical summary, ransomware and use of stolen credentials were each present in 30% of breaches in that sector. Your contracts and your identity/logging architecture need to be built for the reality you are most likely to face, not for the risk register you wish you had.
Contracts are governance. If you sign without leverage, you’ve accepted residual risk—whether you admit it or not.
Stop approving go‑live without proof
The most common leadership failure point is Gate: Pre Go‑Live. Delivery teams are under pressure. The business wants outcomes. Security becomes a negotiation.
For insurance, a defensible go‑live decision includes:
- A plain‑language residual risk memo;
- evidence for critical controls (identity, privileged access, logging and alerting, backup and recovery testing, vulnerability management);
- confirmation that contractual levers work in practice (not just “in the schedule”);
- a live exceptions register with owners and expiry dates; and a funded 30‑60‑90 remediation plan where gaps remain.
If the evidence is “the vendor said so”, you are not ready.
Operational resilience is where reputations are saved or lost
A surprising number of “security incidents” in insurance are really operational failures: patching drift, log gaps, stale keys, untested runbooks, unclear on‑call paths, and vendor handovers that never happened.
This is why BAU handover is a gate, not an admin task.
Your BAU gate should confirm that operational ownership is named and accepted, monitoring and escalation are tested end‑to‑end, remediation cadence is enforced, certificates/keys are not managed informally, and runbooks exist and have been exercised.
A board pack that improves defensibility fast
Boards don’t need a 40‑page cyber report. They need a defensibility view.
A workable monthly pack includes: material initiatives and their gate status, residual risk accepted this month (with owners and expiry), exceptions ageing by owner, assurance sampling results on evidence packs, and incidents tied to delivery or handover gaps.
This shifts leadership from “are we secure?” to “are our decisions defensible?”
What to do in the next 90 days
This will only stick if you pilot it on real work.
In the first 30 days: define materiality triggers, publish the gate policy, create templates (risk memo, exceptions register, RFP scorecard, BAU handover pack), and name decision owners and escalation paths.
In days 31–60: pilot Gates 1–3 on a procurement decision, pilot Gates 4–6 on a delivery initiative, and start a weekly cadence.
In days 61–90: embed gates in PMO stage gates, run assurance sampling, and test decision‑making under pressure with a tabletop exercise.
How Cliffside Helps
If you want this model to stick, treat it like an operating model, not a document. Cliffside can help you implement the gates with templates, training, and assurance that keeps risk explicit as the business moves.
If you have any questions about anything related to this article, or if you’d like to have detailed discussion with our specialists, feel free to get in touch. Contact us online or call our team on (02) 8916 6389!