Small business cyber security: ten basics in official guidance

Official guidance on small business cyber security starts with three measures: multi-factor authentication (MFA), automatic updates and regular backups. The Australian Signals Directorate (ASD) publishes a small business cyber security guide for small businesses and sole traders, and business.gov.au publishes a matching checklist. Many of the measures they describe use settings already built into common accounts and devices, such as multi-factor authentication, automatic updates and Windows Security.

This page summarises ten areas they cover, in the order ASD’s guide treats them where possible. The quick start above lists the priorities; the sections below explain each one. It’s an explainer of official guidance, not an audit or compliance advice. To work through the list and keep a record, see our small business security checklist.

1. Multi-factor authentication

ASD’s guide lists multi-factor authentication (MFA) as one of its three starting measures and says: “Turn on MFA wherever possible, starting with your most important accounts.” ASD’s separate MFA guide lists email first, because access to email can let an attacker reset passwords for other accounts. Securing small business cloud accounts explains the order and the methods. If you use Microsoft 365, see security defaults vs Conditional Access.

2. Strong passwords or passphrases

The guide describes using a password manager to create unique passwords for important accounts, and, for accounts signed into regularly, a passphrase of “a random mix of four or more words”, unique to each account. See password managers.

3. Access controls

The guide says to “ensure each user can access only what they need for their role”. Limiting access reduces the damage if one account is taken over.

4. Shared and admin accounts

The guide describes limiting the use of shared accounts and securing any that are used. Shared accounts make activity hard to track back to a specific person and may let former staff keep access. It also describes protecting administrative accounts with a strong passphrase or MFA.

5. Software updates

The guide says: “Turn on automatic updates for your devices and software”, and “don’t ignore prompts to update”. It also describes replacing products that no longer receive updates from the manufacturer. Our device guides show where the update settings are, for example on Windows and Mac.

6. Security software

The guide describes setting up “security software to complete regular scans on your devices”. It notes that “many small businesses can use Windows Security to protect themselves from viruses and malware”, and that it’s built in to Windows 10 and Windows 11. It also notes that no security software is fully effective, so staff vigilance and updates still matter. The antivirus guide explains what paid products add.

7. Backups

The guide describes backups as “a regular or automatic practice in your business” and creating “a plan to regularly back up your information”. It warns that without regular backups, recovery after an attack may be impossible. The 3-2-1 backup guide explains keeping copies in more than one place. If you use Microsoft 365, see Microsoft 365 backup.

8. Networks and devices

Topics the guide covers include:

• changing a router’s default passwords, considering a guest Wi-Fi network for visitors, and using the strongest encryption available
• auditing and securing internet-exposed services such as Remote Desktop, file shares and webmail
• configuring devices “to automatically lock after a short time of inactivity”
• performing “a factory reset before selling or disposing of business devices”.

See home Wi-Fi and router security and how to prepare a device for selling or recycling.

9. Staff awareness

The guide describes training that covers common threats such as business email compromise and ransomware, spotting scams, business-specific policies such as verifying invoices, and emergency procedures. It says training “isn’t a once-off requirement and should be refreshed periodically”. business.gov.au suggests including it in onboarding. The staff security awareness guide covers short ways to run it.

On invoice scams, the guide describes introducing “a formal process for staff to follow when payment requests are received or bank details are changed”. Scamwatch’s guidance is to contact the business by phone “using a number you have sourced independently”. See payment redirection controls.

10. An emergency plan

The guide says: “An emergency plan could reduce the impact of a cyber attack on your business.” It describes a plan that defines how staff report incidents, who to contact (such as IT professionals and the bank), how staff, stakeholders or customers will be informed, and how the business continues if critical systems are offline. It also describes keeping a hard copy in case systems are offline. See the one-page incident plan.

Data you hold

The guide says to “understand the data your business holds and your responsibilities to protect it”, and notes some businesses have legal privacy obligations. business.gov.au’s checklist refers to the Australian Privacy Principles. The OAIC explains that under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC of a data breach likely to result in serious harm. Whether this applies depends on the business; the OAIC is the official source.

Common questions

How can I protect my small business from cyber threats?

ASD’s small business guide names three starting measures: turning on multi-factor authentication (MFA), turning on automatic updates and backing up important information regularly. It then covers passwords, access controls, shared and admin accounts, security software, networks and devices, staff awareness and an emergency plan, and business.gov.au publishes a matching checklist. Each area is explained on this page, from multi-factor authentication to an emergency plan.

Is there a free cyber health check for small businesses in Australia?

Yes. business.gov.au’s cyber security checklist starts with the ACSC’s free, anonymous Cyber Health Check Tool, which gives tailored suggestions in a few minutes. The checklist also lists the Australian Cyber Security Hotline and other places to get advice. Our small business security checklist is another way to work through the basics and keep a record. See where to get official help.

Is Windows Security enough for a small business?

ASD’s guide notes that “many small businesses can use Windows Security to protect themselves from viruses and malware”, and that it’s built in to Windows 10 and Windows 11. It also notes that no security software is fully effective, so staff vigilance and updates still matter. See security software, and the antivirus guide for what paid products add.

Do I need to train my staff in cyber security?

ASD’s guide includes staff awareness as one of its areas and says training “isn’t a once-off requirement and should be refreshed periodically”. It describes training on common threats such as business email compromise and ransomware, spotting scams, business policies such as verifying invoices, and emergency procedures. business.gov.au suggests including it in onboarding. See staff awareness and the staff security awareness guide.

Does the Notifiable Data Breaches scheme apply to my small business?

It depends on the business, and the OAIC is the official source. The OAIC explains that organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC of a data breach likely to result in serious harm. ASD’s guide notes some businesses have legal privacy obligations, and business.gov.au’s checklist refers to the Australian Privacy Principles. See data you hold.

What do I do if my small business has been hacked or scammed?

Official services can help. business.gov.au lists the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), for help responding to incidents, and the Small Business Cyber Resilience Service for help recovering. IDCARE supports small businesses after a scam or data compromise (1800 595 170, per its contact page). See where to report scams and cybercrime in Australia and the one-page incident plan.

Where to get official help

• A free health check. business.gov.au’s checklist starts with the free, anonymous Cyber Health Check Tool from the ACSC, which gives tailored suggestions in a few minutes.
• The Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), which business.gov.au lists for help preparing for and responding to incidents.
• The Small Business Cyber Resilience Service, which business.gov.au lists for help with resilience and recovering from incidents.
• IT professionals. business.gov.au notes non-government IT service providers and cyber security professionals as another option. The supplier and IT provider guide covers the questions ASD describes asking them.
• Insurance. business.gov.au mentions cyber insurance, noting it’s important to check exactly what a policy covers.

If something has already gone wrong, see where to report scams and cybercrime in Australia.

Related guides

• The Essential Eight explained for small business
• Microsoft 365 security baseline, if you use Microsoft 365