A Practical Cybersecurity Checklist for Australian Small Businesses

The Australian Signals Directorate received more than 84,700 cybercrime reports in the 2024-25 financial year. That works out to one report roughly every six minutes. For small businesses, the average cost of each reported incident rose 14 per cent on the year before.

If that sounds like a problem for bigger companies, it is not. Smaller businesses tend to have weaker defences and no one whose job it is to watch for trouble, which makes them easier targets whatever their size or industry.

This checklist covers the practical steps that give you the most protection for your effort.

Turn on multi-factor authentication everywhere

Multi-factor authentication (MFA) is the single most effective thing you can do to stop account takeovers. Enable it on email, cloud storage, banking, your website admin panel, and any tool that holds client data. Authenticator apps such as Google Authenticator or Microsoft Authenticator are more secure than SMS codes.

If a staff member’s password is stolen through a phishing email, MFA is often what stops the attacker from going any further.

Keep software up to date

Outdated software is one of the most common ways attackers get in. This includes your operating system, browser, plugins, and any third-party applications. Turn on automatic updates wherever possible, and check manually for anything that does not update itself.

For business websites, this means keeping your content management system, plugins, and themes patched. An outdated plugin is a known vulnerability, and automated scanners probe for them constantly.

Use strong, unique passwords

Reusing the same password across different accounts is one of the riskiest habits in small business. If one service is breached, every account sharing that password is at risk.

A password manager makes it practical to use a different strong password for every account. Popular options include Bitwarden (free, open source) and Dashlane. Your team can share credentials without anyone writing passwords on sticky notes or storing them in a shared spreadsheet.

Back up your data, and test the backups

Backups are your main line of defence against ransomware. If an attacker encrypts your files and demands payment, a clean recent backup means you can restore rather than pay. Without one, your options shrink fast.

Automated, off-site backups are the standard to aim for. Daily is a reasonable minimum for most businesses. Critically, test that you can actually restore from them. A backup you have never successfully restored is not a backup you can rely on.

Train your team to spot phishing

A large share of breaches still start with a person, usually someone clicking a malicious link or opening an attachment. The messages are increasingly convincing, often appearing to come from a supplier, a bank, or even your own management.

Regular awareness training does not need to be expensive or time-consuming. A short monthly briefing, combined with a clear process for staff to report anything suspicious, makes a real difference. If you want a primer to share with your team, we have covered how phishing emails work in an earlier post.

Limit who has access to what

Not everyone in your business needs admin access to every system. Restricting privileges means that if one account is compromised, the damage is limited to what that account can reach.

Audit your accounts periodically and remove access for former staff or contractors. This is one of those things that is easy to overlook and expensive to discover later.

Review your website security

Your website is a public-facing system and a common target. Beyond keeping the CMS updated, it is worth checking that SSL is current (your site loads over https, not http), your hosting includes automated backups, login pages are protected against brute-force attempts, and contact forms have bot protection in place.

If your website is a meaningful part of how customers find you or interact with your business, a proper website security review is worth doing at least once a year.

Have a plan before you need one

Knowing what to do in the first few hours of an incident matters more than most businesses realise. Who do you call? Which systems do you isolate first? Who needs to be notified?

A simple incident response plan does not need to be a lengthy document. Write down the key steps, make sure the right people know where to find it, and keep the ASD’s ReportCyber contact handy (1300 CYBER1 or cyber.gov.au/report). Reporting matters because it helps the ASD track active threats and helps other businesses avoid the same attack.

Find your gaps before an attacker does

If you are not sure where your gaps are, the Australian government’s business.gov.au cyber security check is a free starting point. For a hands-on review of your systems and website, the Webics IT and security team can walk through what you have, identify what needs attention, and help you put fixes in place. Get in touch to find out where things stand.