Small business: the 6-step cyber hygiene baseline

Cyber criminals love small businesses: valuable enough to ransom, usually too busy to defend. The good news — you don’t need an IT department to close the doors criminals actually use. These six steps, aligned to the ACSC’s Small Business Cyber Security Guide, stop the overwhelming majority of attacks.

1. 1

   1. Turn on automatic updates everywhere

   Operating systems, browsers, apps, website plugins, point-of-sale systems. Most attacks exploit holes that were patched months ago — updates are free armour. Set them to automatic and never click “remind me later” on critical ones.

2. 2

   2. Back up daily, and keep one copy offline

   Use the 3-2-1 rule: three copies, two different systems, one offline or in a separate cloud account. Test a restore once a quarter — a backup you’ve never tested is a hope, not a plan. Backups are your get-out-of-ransom-free card.

3. 3

   3. Multi-factor authentication on everything that matters

   Email, banking, accounting software, cloud storage, social media admin accounts. MFA is the single highest-value control a small business can switch on — it defeats most credential-theft attacks outright.

4. 4

   4. Train your team for 15 minutes a quarter

   Staff are your firewall. Three messages, repeated: verify payment-change requests by phone; don’t open unexpected attachments; report odd things immediately without blame. A “no blame for reporting” culture is a security control.

5. 5

   5. Lock down payment processes

   Any change to supplier bank details, any new payee, any urgent payment request from “the boss” gets verified by phone on a number you already had — never one from the email. Invoice fraud is the most expensive small-business scam in Australia.

6. 6

   6. Write your one-page response plan

   Who do we call (IT support, bank, ReportCyber 1300 CYBER1)? How do we isolate infected machines? Where are the backups? Who tells customers? Print it. When ransomware hits at 6am, you don’t want to be improvising.