20 Cybersecurity Checks for Australian Small Businesses
Twenty practical checks to discuss with your IT provider, with clear ownership and evidence rather than a false compliance score.
Use this as a conversation, not a certificate
Work through the list with someone who can verify the settings. Mark each item as confirmed, needs work or not applicable, then give every gap an owner. Start with the accounts and services that matter most to your daily operations.
Accounts and access
- 1. Business email and other critical accounts use appropriate MFA.
- 2. Staff have individual accounts rather than shared everyday passwords.
- 3. Administrative access is separated from ordinary work where practical.
- 4. New starters receive only the access approved for their role.
- 5. Departures and role changes follow an agreed access-removal process.
Devices and software
- 6. Supported devices and operating systems are recorded in an inventory.
- 7. Security updates are monitored, with a process for failures and exceptions.
- 8. Endpoint protection is deployed and alerts have a responsible responder.
- 9. Devices holding business data have appropriate encryption and recovery arrangements.
- 10. Software installation and administrative rights follow an approved process.
Information and recovery
- 11. You know where important business information is stored.
- 12. Shared files and external sharing have named owners.
- 13. Backup scope covers the information you intend to recover.
- 14. A recent restore test shows what recovery actually involves.
- 15. Recovery access and contact details are available during an outage.
Everyday routines
- 16. Bank-detail changes are independently verified before payment.
- 17. Staff know how to report suspicious messages without blame.
- 18. Email authentication is reviewed without breaking legitimate senders.
- 19. Incident roles, escalation contacts and decision makers are documented.
- 20. Management reviews open risks and approves the improvement priorities.
Turn findings into a plan
Avoid making broad changes such as blocking entire countries or tightening email rules without testing who will be affected. Confirm licence requirements, pilot the change and keep a recovery path. A useful checklist produces a short list of actions you can track.
Our cybersecurity services can help verify these checks and organise the next steps.
Official reference: ASD Essential Eight guidance.