A cyber security checklist for small business.

Most cyber security advice for a small business comes down to a short list of jobs. The Australian Signals Directorate (ASD) publishes that list in its small business cyber security handbook, and names three places to start: turn on multi-factor authentication, keep your software up to date, and back up your data. This checklist follows the same order.

It is an hour well spent. In 2024-25 the average cost of a cybercrime reported to ASD by a small business was $56,600. Work down the list with whoever looks after your IT and mark each line yes, no or not sure. Treat every not sure as a no until someone has checked.

Accounts and sign-in

• Multi-factor authentication (MFA) is on for email, banking, accounting software, cloud storage and social media. ASD lists these as the accounts to start with.
• Where a passkey or an authenticator app is offered, staff use it. ASD rates a code sent by text message or email as the least secure kind of MFA.
• Every account has its own password, and none is used twice.
• Passwords are kept in a password manager, which is protected by a long master password and MFA of its own.
• Any account that cannot use MFA has a password at least 15 characters long.
• Each person signs in as themselves. Where a shared login cannot be avoided, there is a record of it and of who can use it.

If MFA is new to you, our lesson Multi-factor authentication: what it is and where to start covers the types and the order to turn it on in.

Devices and software

• Automatic updates are switched on for every computer, phone and tablet used for work.
• Someone checks that the updates are going in. That includes servers, storage devices and the router, which are easy to forget.
• Nothing in use has stopped receiving security updates from its maker. Anything that has is being replaced.
• Security software is running on each computer and scans on a schedule. Most modern Windows and Apple computers include it.
• The router no longer has the password it came with, and visitors use a separate guest Wi-Fi network.
• Anything that can be reached from the internet, such as Remote Desktop or file sharing, has been reviewed and switched off where it is not needed.
• The website login is protected with MFA, and the content management system and its plug-ins are up to date.

Backups

ASD suggests writing the backup plan down as the answers to six questions. If you can answer all six, this section is done.

1. What is backed up, and what is not?
2. When do the backups run?
3. Where are the copies stored?
4. Who is responsible for them?
5. How long are they kept?
6. How often are they tested?

Check that the plan covers what sits in email and cloud accounts as well as what is on the office computers. If the last question has no answer yet, A backup you have never restored is a guess explains how to run a restore test, and the 3-2-1 backup rule covers how many copies to keep.

Who can get to what

• Staff can open the files and systems their job needs, and no more.
• Administrator rights are limited to the people who need them, and those people have a separate administrator account for that work.
• When someone leaves or changes role, their access is removed and any shared logins they knew are changed.
• You know which outside providers can get into your systems, and that access is reviewed and removed when it is no longer needed.
• Someone looks at the sign-in logs, and there is an alert for repeated failed login attempts.

People and payments

The two cybercrimes that businesses reported most often to ASD in 2024-25 both involved email: email accounts that were broken into, and business email compromise fraud, where a payment is sent to a criminal who is posing as a supplier or a manager. Most of this section is about habits.

• Staff have been shown how to spot scams and phishing, and why passwords, MFA and updates matter. The training is repeated, because the scams change.
• Everyone knows how to report a suspicious message, and is encouraged to.
• A request to pay a new account, or to change a supplier’s bank details, is confirmed through a trusted channel before any money moves. A phone number you already hold is one. A number in the email that made the request is not.
• New starters are told all of this in their first week.

Our lesson on how to spot a phishing email is short enough to send to the whole team.

A plan for a bad day

• A written plan says how staff report an incident, who to call (the IT provider and the bank, at least), how you will tell staff and customers, and how the business keeps working while systems are down.
• A copy of the plan is kept offline. A plan saved only on the file server is no use when the file server is the problem.
• The plan has been tested, and the contact details in it are current.
• You know whether the Privacy Act 1988 covers your business. If it does, an eligible data breach must be reported to the Office of the Australian Information Commissioner.
• You know that cyber security incidents can be reported to ASD through ReportCyber, or by calling 1300 CYBER1 (1300 292 371).

What to do with the gaps

Close them in the order above. MFA, updates and backups come first because ASD recommends them as the starting point. The handbook also says, fairly, that some of its measures will not apply to every business, so cross out the lines that do not fit yours and move on.

Once the checklist is mostly yes, the next thing to measure yourself against is the Essential Eight, ASD’s framework of eight strategies. Our free Essential Eight assessment takes about five minutes and estimates a maturity level for each of the eight strategies, and The Essential Eight: where a small business should start explains what the result means.

If you would rather have someone else work down the list, putting these fundamentals in place and keeping them there is what our Best Practices service does.