Small business security
Security foundations for small businesses, sole traders and small teams, explained with reference to official Australian guidance. Nothing here is an audit, compliance assessment or professional advice.
Start here
- Small business cyber security: ten basics in official guidanceSmall business cyber security explained: ten basics from ASD's small business guide and business.gov.au, from MFA and backups to staff training.
- The Essential Eight explained for small businessWhat is the Essential Eight? A plain-English explainer of ASD's eight strategies, how maturity levels work, and what its small business guide says.
- Payment redirection fraud: the payment controls official guidance describesHow payment redirection scams get businesses to pay a scammer's account, and the invoice checks Scamwatch, ASD and ASIC describe to catch them.
Planning and recovery
People and policies
- Cyber security policies for small teams: what they cover, with a one-page outlineA cyber security policy for small business, explained: the simple policies small teams write, what each covers, and a one-page outline to adapt.
- Staff cyber security awareness for small teams: what it covers and how it runsCyber security awareness training for staff, explained: the topics ASD's small business guide lists, how small teams run it, and what to watch for.
Fundamentals
- Payment redirection fraud: the payment controls official guidance describesHow payment redirection scams get businesses to pay a scammer's account, and the invoice checks Scamwatch, ASD and ASIC describe to catch them.
- Small business cyber security: ten basics in official guidanceSmall business cyber security explained: ten basics from ASD's small business guide and business.gov.au, from MFA and backups to staff training.
- A one-page cyber incident plan for small teamsA one-page cyber incident response plan template for small teams, based on ASD's guide: who decides, who to contact, how to communicate and keep trading.
Accounts and suppliers
- Securing small business cloud accounts: email, accounting, files and your domainHow to secure business cloud accounts: MFA, admin accounts, recovery details, domain renewal, and removing access when staff leave.
- Supplier and IT provider security: the risks and the questions small businesses askSupplier cyber security risk for small business: how IT providers and suppliers affect you, questions ASD describes asking, and managing provider access.
Frameworks
Small business security: questions people ask
How can I protect my small business from cyber threats?
ASD's ACSC lists basics such as multi-factor authentication, updates, backups, access controls and staff awareness. Our guide covers each one. Small business cyber security basics
What is the Essential Eight?
The Essential Eight is ASD's set of eight mitigation strategies. Our guide explains each one and how maturity levels work, in plain English. Essential Eight explained
How do I stop fake invoice scams?
Official guidance describes checking any change of bank details by phone, using a number you already have, before paying. Payment redirection controls