“We’re only a small business. Why would anyone target us?” It sounds reasonable.
Unfortunately, cyber attacks do not always involve somebody deliberately choosing your organisation.
Phishing, stolen passwords and malicious software can affect organisations of all sizes.
Australian Government data shows the risk is real. In 2024–25, the average self-reported cost of cybercrime for a small business was $56,600 per report, up 14% on the previous year.
Because you cannot fix everything at once. Most SMEs have limited time, money and people.
A strategy helps you decide what matters most.
For smaller organisations, the Australian Cyber Security Centre recommends starting with measures including:
These are understandable, practical starting points
ASD Essentials provides a broader Australian framework for reducing cyber risk. Released in October 2026, it evolves the long-standing Essential Eight.
Its enterprise IT chapter covers eight areas, including identity services, user devices, business systems, privileged environments, and governance and culture. If your business has already worked towards the Essential Eight, that work still counts.
Your business may not need to implement everything at once.
The point is to establish a direction
Your business may not need to implement everything at once. The point is to establish a direction.
Your leadership team does not need to understand every security setting. It should understand:
Attackers often use widespread methods such as phishing, stolen passwords and malicious software rather than selecting one organisation by name. Small businesses also hold valuable information and may have fewer security resources.
Start with multi-factor authentication, current software, reliable backups and clear employee guidance. Then assess access, devices, business-critical systems and incident response.
ASD Essentials is the Australian Signals Directorate’s cybersecurity framework, released in October 2026 as the evolution of the Essential Eight. It provides a prioritised approach to reducing cyber risk across enterprise IT, cloud and operational technology. Existing Essential Eight work carries forward into it.
The appropriate target depends on the organisation’s risks, customers, contracts and regulatory obligations. An assessment can help determine the most practical order and level of implementation.
Leadership should own the business risk, while internal IT staff or an MSP may manage the technical work. Responsibilities, decisions and reporting should be clearly defined.
