IT Business Insurance
Perth, Sydney, Melbourne, Brisbane & Canberra

An IT business should explain the boundary between advice, implementation and ongoing operation. A developer building a brochure website has a different exposure from a managed service provider administering client networks or a software vendor hosting business critical transactions. List the services delivered, the industries served and the largest client dependencies. Include hosting, cloud administration, data migration, cybersecurity work, integrations and automated processes where relevant. If the business can change a customer’s live environment or access privileged accounts, explain the approval and access model. An insurer needs more than a broad description such as computer services.

Review where one mistake could affect several customers. Shared hosting, a common deployment tool or a central remote management platform can create an accumulation of loss. Record how backups are separated, restoration is checked and emergency access is controlled. Describe subcontractors and third party platforms that provide material parts of the service. These facts help distinguish a professional error from a cyber event, though one incident may involve both. Ask how the policies interact where a faulty release causes downtime and a compromised account is also suspected. Coverage should be assessed from the actual wording rather than the product name.

Supply representative statements of work, support agreements and service level commitments. Pay particular attention to uptime promises, credits, unlimited indemnities, security guarantees and the customer’s right to recover lost revenue. Obligations accepted in a contract can be broader than the liability a policy is designed to insure. Ask whether the definition of professional services includes every revenue stream and whether intellectual property allegations or loss of client data are addressed. Overseas customers and contracts governed outside Australia deserve specific discussion, especially where the chosen policy places limits on territorial or jurisdictional scope.

Maintain records of client acceptance, test results and approved changes. For migrations, record what data was in scope, which backups were available and who confirmed completion. For ongoing support, preserve the ticket history and agreed responsibilities for patching, licensing and third party subscriptions. Cyber proposals should describe actual controls, not an intended future state. If a control cannot be applied consistently across older systems, explain the exception. Check how incident response costs, dependent service provider outages, funds transfer fraud and contractual service credits are treated; these are separate questions even when they arise from the same outage.

Create a response plan that assigns technical containment, client communication and insurer contact to named roles. Keep access to the plan and relevant contact details outside the systems most likely to fail. Preserve logs and deployment records before restoration overwrites evidence. A clean rebuild may be technically sensible, but the sequence should allow investigation where practical. Record when each client was affected and restored, and separate incident response costs from ordinary support work. Notify potential claims promptly through the agreed process, including a customer’s allegation that a release or recommendation caused financial loss.

At renewal, review growth in hosted sites, managed devices, recurring revenue and customer concentration. New use of automation or artificial intelligence may change the service scope and the approvals needed before output reaches a client. Revisit the cost and time required to restore the largest environment, not just a small test account. Check that the insured entity matches the entity signing contracts and that acquired products or trading names are declared. A coordinated professional indemnity and cyber review can reveal gaps between client promises, operational control and policy triggers before a difficult incident makes those boundaries urgent.