Cyber security for small business in Australia comes down to a handful of basics done consistently: strong sign-in protection, updated devices, email filtering, tested backups and staff who know what a scam looks like. Attackers rarely target small businesses personally. They use automated tools and look for the easiest door.
Use this small business cyber security checklist to see where you stand.
Cyber security for small business: 8 steps
1. Turn on multi-factor authentication everywhere
A stolen password is useless if a second step is required. Turn on multi-factor authentication (MFA) for email, Microsoft 365, banking, accounting software and every admin login. Start with email, because it is the key to resetting everything else.
2. Protect your email from phishing and fake invoices
Most small business incidents begin with an email: a fake invoice, a “payment details have changed” message or a login link that looks real. Email filtering catches much of it, and sign-in alerts flag unusual access. Add one simple rule: always confirm bank detail changes by phone, using a number you already have.
3. Keep devices and software updated
Updates fix known security holes. Set operating systems and applications to update automatically, and retire devices that no longer receive updates.
4. Limit administrator access
Day-to-day accounts should not have administrator rights. If malware lands on a standard account, the damage is far more limited.
5. Back up your data and test the restore
A backup you have never restored is a guess. Keep copies separate from your main systems so ransomware cannot encrypt both, and test recovery regularly.
6. Secure every laptop and phone
Devices need endpoint security, disk encryption and the ability to be locked or wiped if lost.
7. Train your staff to spot scams
People are your first line of defence. Short phishing awareness sessions and a clear way to report suspicious emails make a real difference.
8. Know your privacy obligations
If your business is covered by the Privacy Act, you may need to notify affected people and the Office of the Australian Information Commissioner when an eligible data breach occurs. Many small businesses are exempt, but not all, so confirm your position.
Use the Essential Eight as your guide
The Australian Cyber Security Centre’s Essential Eight is a good framework for deciding what to fix next. Read our guide: The Essential Eight explained.
Get a second opinion
Our free IT health check reviews your Microsoft 365 setup, devices, email security, MFA, admin access and backups, and gives you a short written report of what to fix first, with no obligation.
Book your free IT health check or learn about our cyber security services and managed IT services.
FAQ
What is the most important cyber security step for a small business?
Turn on multi-factor authentication for email and admin accounts. It blocks most password-based attacks.
Can a small business be a target for ransomware?
Yes. Attacks are largely automated, so size does not protect you. Tested backups and regular updates are your best defence.
How can I protect my business from fake invoice scams?
Verify any change to bank details by calling the supplier on a known number, and use email filtering and sign-in alerts.
