Why governance — not tooling — is the gap
Most Australian SMEs have some level of technical control already. The gap is governance: nobody owns the decision, nobody reports on it and nothing is tested. Closing that gap is cheaper and faster than buying more tools.
The six-item governance baseline
Minimum defensible baseline
- Named accountable owner for cybersecurity at executive or director level.
- Documented baseline aligned to ACSC Essential Eight Maturity Level One (minimum).
- Supplier and managed service provider register with right-to-audit clauses.
- Tested incident response plan — at minimum, one tabletop in the last 12 months.
- Cyber insurance with current declarations and aligned breach notification path.
- Quarterly cyber update to leadership; annual deep-dive at the board or owners meeting.
What the Privacy Act reforms change
The reforms reduce the small-business exemption, introduce a statutory tort for serious invasion of privacy and increase penalties. For SMEs, this means breach readiness, retention review and a documented privacy program are no longer optional.
How to govern outsourced IT
Most SMEs run on a managed service provider. The MSP is your single largest cyber dependency. Maintain a written services schedule, a right-to-audit clause, evidence of the MSP's own controls and a tested incident notification path. If the MSP cannot provide these, it is the wrong MSP.
FOR SME LEADERS WITHOUT A CISO
Structure your SME's cyber decisions like an enterprise — in 60 seconds.
FORTE/CYBERx is the AI decision support platform for Australian leaders. Bring the challenge, get ranked options and a tactical plan.
Start a free missionReporting cadence that fits an SME
- Monthly: 15-minute MSP / IT update on incidents, patching and backup status.
- Quarterly: leadership review — Essential Eight progress, supplier register, insurance status.
- Annually: board / owners review — full posture, tabletop exercise outcome, investment intent.
FAQ
What does cybersecurity governance mean for an Australian SME?
Cybersecurity governance for an SME is the documented set of decisions, ownership, controls and reporting that demonstrates the business is managing cyber risk in a way it can defend to customers, insurers and regulators. It does not require a CISO — it requires accountability, a baseline aligned to ACSC Essential Eight and tested incident readiness.
Do Australian SMEs need to follow Essential Eight?
Essential Eight is not legally mandated for SMEs but is the de facto Australian baseline. Customers, insurers and government contracts increasingly require Maturity Level One as a minimum. For SMEs in regulated supply chains, Maturity Level Two is rapidly becoming the threshold.
What changes for SMEs under the Privacy Act reforms?
The Privacy Act reforms expand obligations on small businesses previously exempt under the AUD 3 million turnover threshold, introduce statutory tort for serious invasions of privacy and raise penalties. SMEs handling personal information should now treat themselves as covered entities and align breach response to OAIC expectations.
Who is accountable for cyber in an SME without a CISO?
Ultimate accountability sits with the directors and owner. Day-to-day responsibility typically sits with the head of IT or an outsourced provider. The critical governance step is making the assignment explicit, documented and reported on — not leaving it implicit.