Free checklist · PDF download

The Cyber Security Checklist for Australian Small & Mid-Sized Businesses

Most SMB breaches come down to the same handful of gaps: a reused password, an unpatched laptop, a convincing invoice email, a backup that was never tested. This free 30-point checklist covers the five domains where Australian small businesses are actually breached — so you can score yourself honestly in under an hour and know exactly where to spend first.

Aligned to ACSC guidance and the Essential Eight Covers Privacy Act and NDB obligations

Why a checklist, and why now

The ACSC receives a cybercrime report roughly every six minutes, and small business is the most reported category. The pattern behind most incidents is not sophisticated — it is a known gap that nobody had written down. A checklist turns “we think we’re covered” into a scored, evidence-based answer you can hand to your accountant, your insurer or your board.

What the checklist covers

Identity and access — MFA, shared accounts, offboarding and privilege control.
Devices and software — patching, encryption, unsupported systems and device inventory.
Email and phishing — domain spoofing protection, payment verification and staff reporting culture.
Data and backups — isolated backups, tested restoration and Privacy Act data awareness.
Incident readiness — a written plan, named contacts, NDB obligations and tabletop practice.

How to score yourself

Mark each item as in place and evidenced, partially in place, or not in place. Any domain where fewer than half the checks pass is where your next security dollar should go. If you would like a second set of eyes, bring your completed checklist to us and we will prioritise it with you — straight answers, no sales sequence.

FREE RESOURCE

The Cyber Security Checklist for Australian SMBs

Thirty practical checks across the five domains where small and mid-sized Australian businesses are actually breached — identity, devices, email, data and incident readiness — ordered so you can score yourself in under an hour.

Identity and access — lock the front door

Compromised credentials cause most SMB breaches. These checks confirm the right people have the right access — and nobody else does.

MFA is enforced on every email account, cloud service and remote access path — no exceptions for owners or executives
Every person has their own account; no shared logins for email, accounting or line-of-business systems
Admin rights are limited to a small named group and never used for day-to-day email or browsing