Insurance brokerages retain sensitive information such as policy schedules, claims histories, identity records, financial disclosures and correspondence.
When historical data sits in forgotten servers, backup platforms, inherited systems or former branch environments, it creates a hidden attack surface. The key question for boards is not whether a retention policy exists, but whether management can prove that legacy information is retained, protected and disposed of in line with legal and business requirements.
A well-scoped cyber security audit should help provide that evidence.
Legacy Data Creates Accumulating Risk
Historical records may remain in decommissioned servers, archived email accounts, cloud storage, backup appliances and systems inherited through mergers. Some data must be retained for legal, claims-management or contractual reasons. Other records may no longer serve a documented purpose.
The governance problem begins when the brokerage cannot distinguish between the two.
Unnecessary retention increases the volume of data exposed during an incident. It can complicate cyber insurance renewals, procurement reviews, regulatory enquiries and M&A due diligence.
Boards should be able to explain why data is retained, where it is stored, who can access it and how it will eventually be destroyed or de-identified.
SaaS Migration Does Not Remove Responsibility
Moving operations to a cloud or SaaS platform can improve efficiency and security, but it does not resolve risks within systems left behind.
During migrations, historical servers are often kept “just in case.” Over time, ownership becomes unclear, monitoring declines, patching becomes inconsistent and the systems may disappear from asset inventories.
The cloud provider may secure its platform, but the brokerage remains responsible for governing information across its full lifecycle.
A targeted secure configuration review can determine whether legacy platforms still meet security requirements. It should examine software support, patching, administrative access, encryption, logging, backups and connections to production systems. It should also confirm whether the information still has a legitimate purpose.
Regulatory Expectations Require Evidence
For brokerages operating within APRA-regulated entities, CPS 234 sets expectations for information-security governance, control implementation and control-effectiveness testing.
Brokerages serving APRA-regulated organisations may also face contractual assurance requirements because regulated clients must understand how service providers protect their information.
Under Australian Privacy Principle 11, covered organisations must take reasonable steps to protect personal information. Where that information is no longer required for a permitted purpose, it may need to be destroyed or de-identified, subject to applicable retention obligations.
In New Zealand, Information Privacy Principle 9 similarly states that personal information should not be retained longer than required for a lawful purpose.
Across Australia and New Zealand, retention decisions should be documented, consistently applied and supported by evidence. A policy alone is not enough.
This requires organisations to connect privacy, compliance and responsible data handling with the technical controls governing how information is collected, stored, accessed and disposed of.
The Gap Between Policy and Execution
A policy may require records to be deleted after a defined period, while copies remain in backups, test environments, staff devices, email attachments, exported spreadsheets or acquired systems.
Boards and risk committees should ask:
• Can management produce a current inventory of active, archived and backed-up repositories?
• Is each retention period linked to a documented legal, contractual or business requirement?
• Are legacy systems included in access reviews, patching and monitoring?
• Can the organisation demonstrate that expired information has been destroyed or de-identified?
• Has control effectiveness been independently tested?
These are not questions that should remain within the technology function. They reflect why cyber security now belongs in the boardroom and why directors need clear evidence of control effectiveness.
These questions move the discussion from policy ownership to control effectiveness.
Finding Shadow Archives Before an Incident
Acquisitions, office relocations, platform migrations and service-provider changes can create additional copies of client data.
An acquired business may retain a local server after integration. A former branch may store documents in an unmanaged cloud account. An old backup appliance may remain connected because no one has confirmed whether its contents can be removed.
Where legacy systems remain connected, a comprehensive vulnerability assessment can identify unsupported software, insecure services, weak configurations and exploitable paths.
However, vulnerability testing should complement, not replace, repository discovery, data classification, retention validation, privileged-access testing and disposal-control reviews. The objective is to establish whether the brokerage can account for sensitive information throughout its lifecycle.
Independent Assurance Should Strengthen Internal Teams
Internal IT and security teams hold essential operational knowledge. Their involvement is critical, but they should not be the sole source of assurance over controls they design and administer.
Independent validation tests assumptions against recognised security practices. Depending on the scope, this may involve cyber security assessors, privacy specialists or ISO 27001 information security auditors.
A useful review should explain which repositories contain the most sensitive information, which weaknesses create the greatest exposure, which controls are not operating as intended and which remediation actions require priority.
That is the difference between a technical report and a board-ready assurance outcome.
What Boards Should Expect From a Specialist Assessor
When selecting a certified cyber security consultant in Australia, boards should look beyond service lists and certification logos.
They should understand who will perform the work, whether senior assessors will remain involved, how quickly material findings will be escalated and whether recommendations will be practical and prioritised.
Direct access to experienced assessors reduces interpretation gaps and keeps the engagement connected to the brokerage’s operating environment and commercial priorities.
Data Governance as Commercial Assurance
Effective data governance can support client confidence, insurance renewals, procurement processes and transaction readiness.
A brokerage that can produce independent evidence of its data-lifecycle controls is better positioned to demonstrate where sensitive information is held, why it is retained, how access is controlled and how expired data is disposed of.
Cybernetic Global Intelligence helps organisations translate documented policies into verifiable technical and governance evidence. A focused assessment can map legacy repositories, evaluate privileged access, review retention and disposal workflows, test selected controls and identify gaps between policy and execution.
Engagements are led by experienced assessors, giving executives direct access to the specialists performing the work and enabling practical, board-ready outcomes.
Legacy client data becomes a board-level liability when no one can confidently explain why it exists, where it resides, who can access it or whether its controls operate as intended.
The strongest response is not another policy document. It is independent, technically informed evidence that the organisation’s data-lifecycle controls work in practice.
Contact us to find out how Cybernetic Global Intelligence supports cyber security, compliance and data-governance assurance.