Chubb Australia's cyber proposal form (11/2023): what it asks about email and MFA

This page covers one form: Chubb Insurance Australia Limited's Cyber Enterprise Risk Management, Short MarketPlace Cyber Proposal Form, "Published 11/2023." It's an Australian form for businesses with revenue under $50m, and it asks directly about MFA on email and about an email security solution. It doesn't describe Chubb's applications in the US or any other country, which may ask different questions. If your client is outside Australia, ask the broker for the form that applies. This isn't insurance advice. Chubb decides what an answer means.

About the form

• Issuer: Chubb Insurance Australia Limited.
• Edition: "Chubb Cyber ERM Short MarketPlace Cyber Proposal Form, Australia. Published 11/2023." Six pages.
• Who it's for: "Businesses with revenue of Less than $50m."
• Scope: "You" and "Your" mean the Named Insured and all its subsidiaries. If security policies differ between companies, the form asks for a separate proposal form for each information system.
• Source: a public PDF on chubb.com's Australian site.

The email and MFA questions

Q7: remote access to network and email

> Your Corporate Network and email cannot be accessed remotely or where remote access to your Corporate Network and email are required Multi-Factor Authentication is used?

It's a single Yes/No covering two conditions. "Yes" means either there's no remote access at all, or MFA is used wherever remote access is needed. For a client on Microsoft 365 or Google Workspace, email is remotely accessible, so "Yes" depends on MFA being used for it.

When it's only partly true. Because Q7 joins network and email in one question, it can't express a split. MFA might cover Microsoft 365 but not a remote desktop gateway, or the reverse. A plain "Yes" would overstate it in either case. Tell the broker in writing which part isn't covered, and when it will be.

The form's glossary defines MFA as two or more of something you know, have, or are. It adds:

> Note that the following are not considered secure second factors: a shared secret key, an IP or MAC address, a VPN, a monthly reauthentication procedure, or VOIP authentication.

So "users are on the VPN" or "we only allow office IPs" don't count as a second factor under this form's definition.

Q10: email security solution

> Do you have an email security solution in place (for example - Password Management, Sandbox, Spam Filters, Encryption, Security Tools)

The glossary defines Spam Filters as "a program used to detect unsolicited, unwanted and virus-infected emails and prevent those messages from getting to a user's inbox." It defines Sandbox as "a secure, isolated environment for running potentially malicious software or files." It defines Security Tool as "any tools designed to protect your email from malware and hackers, which could include anti-malware software and anti-phishing products." The examples are broad, so be specific about what's in place when the broker asks.

Other questions an MSP will help with

• Q1: whether the insured operates as an "IT Managed Service Provider," among other listed activities.
• Q8: backups for business-critical systems at least weekly, "and are they stored offline?"
• Q9: "an security tool protecting computers and handheld devices (for example -Anti-Virus Software, Anti-malware, Endpoint Detection and Response)."
• Q11: contact details for "the client's Chief Information Security Officer or other staff member who is responsible for data and network security." Agree with the client in advance whether that's their person or yours.
• Optional Social Engineering Fraud section: whether changes to vendor details are confirmed "by a direct call using only the contract number previously provided," plus segregation of duties and dual authorisation for payments.

Declaration

It's signed by a "Director, Officer or Risk Manager." The insured agrees notice "will be given as soon as practicable" if information changes before inception.

How an MSP can prepare

1. Confirm the form. Make sure the broker is using this Australian 11/2023 form, not another edition.
2. Q7: export MFA coverage for email and every remote-access path, including your own remote-support tools. Note any users who rely on factors the glossary excludes, such as "VPN only" or office-IP restrictions.
3. Q10: list the spam filter, sandboxing and anti-phishing products by name and license, so the broker can describe them if asked.
4. Q8 and Q9: confirm weekly backups and that a copy is offline. Confirm security tooling covers handheld devices as well as computers.
5. Q11: agree whose name goes in the security contact field, and make sure that inbox is monitored.
6. Social Engineering Fraud section: finance answers these. You can show them how lookalike-domain and compromised-mailbox fraud works.
7. Keep dated evidence for whoever signs, and tell the client to update Chubb if anything changes before inception.

What the form doesn't ask

It has no question about SPF, DKIM or DMARC. Q10 asks only whether an email security solution is in place. Don't tell a client this form depends on their DMARC policy.

Document the DNS side

Run the free insurance email controls check →

It maps public DNS (DMARC, SPF, DKIM, filtering) to common application questions and labels each Verified, Unknown or Not tested, with evidence you can paste. MFA and payment processes stay Not tested. It's not insurance advice.

Founding Partner: $1,999, one time. Give every client a branded, dated email security record before renewal. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →