Cyber security checklist

Use the Cyber Health Check Tool to see what your business is doing well and where you can improve cyber security.

The tool is free, anonymous and only takes a few minutes to complete. You'll receive simple, tailored suggestions to make your business more cyber secure.

Cyber security starts by choosing digital tools and devices that prioritise security and privacy:

• Choose well-known providers with good reputations.
• Check the provider’s website to see if they have any compliance certifications, such as the ISO27001 standard.
• Make sure they provide ongoing security updates and support.

You also need to regularly apply updates to keep your systems safe:

• Install updates as soon as possible, especially when it fixes a security issue.
• Turn on automatic updates if you can.
• Act on any other security advice from the provider.
• Once software or devices no longer get security updates, replace them.

Take sensible precautions to reduce the risk of a cyber incident.

Accounts

• Turn on multi-factor authentication (MFA) for your accounts. MFA combines passwords with an extra verification step. For example, entering a code sent to your phone or email, scanning your face or fingerprint, or using an authenticator app.
• Use passkeys for tools and websites that support them. Passkeys replace passwords and don’t need an additional MFA step. They are extremely secure.
• If you can’t use passkeys, choose unpredictable passwords that are at least 15 characters long.
• Don’t use the same password for more than one account. Use a password manager to safely store unique passwords for all your accounts.
• Avoid sharing accounts between staff members.
• Remove staff members’ accounts as soon as they stop working in your business. You should also change any shared login details.

Information

• Back up information regularly (or automatically) so you can restore it after a cyber incident.
• Manage staff permissions so each employee only has access to the systems and data they need for their job.
• Be careful when sharing sensitive information with chatbots and other AI tools – do you know how it will be stored, used or shared?

Devices

• Use antivirus or security software on your computers.
• Store your devices securely. Don’t leave them in places where unauthorised people can access them.
• Protect devices with a password, passkey, PIN, fingerprint or facial recognition.
• Set devices to lock automatically when not in use.
• Before selling or disposing of a device, delete all information and do a factory reset.

Small business owners are often the targets of scams where criminals try to trick you into giving them money or personal information. If the goal of the scam is to get your personal information, it’s called a phishing scam.

Scammers usually contact you via email, text message or a phone call. Their messages may seem like they are from a legitimate business or the government. Often they will ask you to log into a fake website, download a file or transfer money or gift cards.

It’s important to know the signs of a scam so you can avoid losing money or giving cyber criminals access to your systems.

You need to keep your customers' information safe. Losing or compromising their information will damage your business reputation and could have legal consequences.

Make sure you:

• only collect customer data that is essential for your business
• store customers’ personal information securely
• delete customer data when you no longer need it.

If you take payments online, find out what your payment provider does to prevent online payment fraud.

Australia has laws about what you can do with personal information you collect from customers. You should understand these laws and have a clear, up-to-date privacy policy. It’s a good idea to display your privacy policy on your business website.

A cyber security policy helps your staff understand their responsibilities when they use or share:

• accounts
• data
• computers or other devices
• email
• websites and social media.

Your policy should also include an incident response plan outlining what you and your staff will do in the event of a cyber incident.

Cyber security is everyone’s responsibility. Teach your staff about common cyber threats and how to protect against them.

This includes:

• providing regular training. Scams and cyber threats are always evolving, so it’s important to keep your workers’ knowledge up to date
• making sure staff understand your cyber security policy and their responsibilities
• encouraging staff to report anything suspicious.

The cost of dealing with a cyber-attack can be more than just repairing databases or replacing laptops. For example, you might be unable to run your business for a while or need to compensate customers for data loss.

Cyber insurance can help your business cover the costs of an attack. Like all insurance policies, it’s important to understand exactly what you are covered for.

There are places to go for support and advice on cyber security.

You can:

• Call the Australian Cyber Security Hotline on 1300 292 371 for help preparing for and responding to cyber incidents.
• Get help with cyber resilience or recovering from an incident through the Small Business Cyber Resilience Service.
• Get individual support through the Digital Solutions – Australian Small Business Advisory Services program. This program gives small businesses low-cost, high-quality advice on digital solutions, including online security.
• Engage private IT providers or cyber security professionals.

Cyber criminals are constantly coming up with new threats. It’s important to keep up with the latest scams and security risks to your business.

You can:

• Become an Australian Signals Directorate partner to receive up-to-date information on cyber security issues and how to deal with them.
• Sign up for cyber.gov.au alerts or check their alerts and advisories page regularly.