This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
Secure the accounts that matter most
List your business email, domain registrar, hosting, banking, booking and administration accounts. These are the accounts where a compromise could cause the greatest disruption.
- Enable multifactor authentication or a passkey wherever the provider supports it.
- Use a different strong password for every account and store passwords in a reputable password manager.
- Keep account recovery options up to date, including backup methods that you control.
Maintain your devices and website
Security updates matter for websites as well as laptops and phones. Identify who is responsible for applying updates and confirming that a website is supported.
- Turn on automatic updates where appropriate and promptly apply important patches.
- Remove accounts and software that are no longer needed.
- Keep the website CMS, plugins, server software and dependencies maintained.
Make a backup you can actually restore
A backup is useful only when a business can recover the files and data it needs.
- Keep backup copies separate from the systems they protect.
- Test a restore and record whether the recovered system works.
- Protect backups from accidental deletion and compromised administrator accounts.
Reduce payment and impersonation risks
A realistic-looking invoice, text message or voice call is not proof that a request is genuine.
- Confirm changed bank details through a trusted number obtained independently.
- Give staff a clear process for suspicious requests and unexpected attachments.
- Use a recognised payment service and avoid collecting payment-card details unnecessarily.
Plan for the day something goes wrong
Decide beforehand who can contact the bank, hosting provider, email provider, customers and specialist support.
- Keep a short incident contact sheet accessible without your usual online accounts.
- Document who can contain a problem, preserve evidence and approve recovery actions.
- Review your controls regularly, particularly after business changes.
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Small business cyber security handbookASD’s Australian Cyber Security Centre · 7 October 2026
- Implement fundamental cyber security controlsASD’s Australian Cyber Security Centre · 7 October 2026
- Implement and test cyber security incident response plansASD’s Australian Cyber Security Centre · 7 October 2026
