Start here

Just tell me what to do to protect my business.

No frameworks, no acronyms, no 200-page documents. This is the list we would give a friend who owns a business: five things this week, six this month, six this quarter, and what to do if something goes wrong.

Figures from ASD's Annual Cyber Threat Report 2024-25, checked 30 October 2026.

Get someone to do it for you Run the ten-point check 07 3114 2808

This week, month, quarter
Ten-point check
What to do if it happens

Reviewed by Blake Bath, General Manager, on 30 October 2026.

The owner of a garden supplies yard works through a printed checklist at his site office desk, with a ute and bags of mulch outside the window. — **Do these two today**MFA on every email account, and phone to confirm any change to bank details.

What actually happens

The crimes Australian businesses report most.

From ASD's latest annual report. The list below is built to stop these first.

Email accounts taken over

19% of business cybercrime reports were email compromise with no money lost. Often that is only because someone noticed in time.

Stolen passwords
No MFA
Forwarding rules set up

This week

Five things to do this week.

Turn on MFA for every email accountOwner, bookkeeper and anyone who handles invoices first. Use an authenticator app, not text messages. If you are on Microsoft 365 with no Conditional Access, Security Defaults turns on MFA for everyone at no cost.
Make the phone-call ruleAny change to bank details, or any urgent payment request, gets confirmed by phone on a number you already had. Never reply to the email to check.
Lock every computerA password or PIN on every laptop and desktop, and screens that lock when people walk away. One login per person.
Check your email is backed upMicrosoft 365 and Google keep deleted items for a while, not forever. Find out whether you have a separate backup.
List who has admin accessEmail, accounting, banking, website, domain. If you cannot list them in five minutes, that is the first problem.

This month

Six things to do this month.

Move everyone onto business emailNo personal Gmail or Outlook accounts for work. Each person gets their own named account the business controls.
Turn on automatic updatesWindows, Mac, phones, browsers and main apps. Replace anything that no longer gets security fixes.
Put endpoint protection on every computerMicrosoft Defender for Business is included in Microsoft 365 Business Premium. Someone needs to watch its alerts.
Roll out a password managerRetire the password spreadsheet and stop reuse. Connect it to your work sign-in where you can.
Test a restorePick a file and a mailbox and restore them. Keep one backup copy that attackers cannot delete.
Write a one-page incident planIf X happens, call Y. Include your bank's fraud line and your IT provider's after-hours number.

This quarter

Six things to do this quarter.

Run a short staff sessionThirty minutes on fake invoices, phishing emails and who to tell. Keep it human.
Review who has access to whatAnyone who left in the last year comes out of every system, including shared logins.
Separate admin accountsThe account people read email with should not be able to change settings or add users.
Talk to your broker about cyber insuranceKnow what the application will ask. The answers usually line up with this list.
Pick a framework if customers askEssential Eight as the baseline. SMB1001 if you want a certificate to show.
Give one person the jobInside the business or outside it, one name is accountable for IT and cyber.

Stop doing

Stop doing these now.

Sharing logins between staffOne login per person, so you can see who did what and remove one person cleanly.
Paying changed bank details without a callFifteen percent of business cybercrime reports were this kind of fraud with money lost.
Text message codes where an app is availableCodes sent by SMS can be intercepted through SIM swaps. Use an authenticator app or passkeys.
Personal Dropbox or Google Drive for work filesWhen the person leaves, the files go with them.
Keeping the old server because it still worksUnsupported systems get no security fixes. Plan the move before it fails.

Free things

Useful things that cost nothing.

Microsoft 365 Security DefaultsMFA for every account and legacy sign-in blocked, in every tenant.
Microsoft Secure ScoreA score for your tenant with a list of settings to improve.
Login alerts on banking and accountingAn email when someone signs in from somewhere new.
ASD alerts and ReportCyberSubscribe at cyber.gov.au, and bookmark the reporting page before you need it.
Protective DNSQuad9 (9.9.9.9) or Cloudflare (1.1.1.2) on the office router blocks many known bad sites.

If something goes wrong

What to do in the first hour.

Call the bank if money movedSome payments can be recalled if you act quickly. Hours matter.
Disconnect, do not switch offUnplug the network cable and turn off Wi-Fi on a computer acting strangely. Leave it powered on.
Change key passwords from a clean deviceOwner, finance and admin accounts first, not from the computer you suspect.
Call your IT providerDo not poke around yourself. You can destroy what shows how they got in.
Report and notifyReport through ReportCyber. Check whether the Notifiable Data Breaches scheme applies, and if a ransom was paid and turnover is over A$3 million, report the payment to ASD within 72 hours.

If we do it with you

How we work through the list.

Step 1Check
We run this list against your systems and show you the gaps.
Step 2Fix the urgent
MFA, payment checks and backups first.
Step 3Set it up properly
Updates, protection, password manager and admin accounts.
Step 4Keep it in place
Watched every day, reviewed as staff and systems change.

When you want more

The checklist is the start. Here is the detail.

Each of these guides goes deeper on one part of the list.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

Quick answers to what owners ask.

What is the single most important thing to do first?

Turn on MFA for every email account, and have a rule that any change to bank details is confirmed by phone. Email takeover and payment fraud are the two most reported cybercrimes against Australian businesses. Then make sure your backups work.

We are five people. Do we really need all this?

Yes, but the five-person version is small. MFA, a working backup, updates, endpoint protection and a password manager matter at any size. ASD's figures put the average reported cost of cybercrime for a small business at A$56,600.

Can we do this ourselves?

Most of the list, yes, if one person owns it. Where businesses come unstuck is keeping it up: MFA when staff change, testing backups, reviewing who has admin, and responding to alerts at night. That ongoing work is what a managed IT provider does.

Do we have to report a cyber attack?

It depends. If personal information is involved and serious harm is likely, the Notifiable Data Breaches scheme applies to most businesses with turnover over A$3 million and some smaller ones, and the OAIC expects you to assess a suspected breach within 30 days. If you pay a ransom and your turnover is over A$3 million, you must report the payment to ASD within 72 hours. Anyone can report cybercrime through ReportCyber.

Which framework should we follow?

Start with the Essential Eight, the Australian government's baseline. If you want a certificate to show insurers and customers, SMB1001 is built for businesses your size. ISO 27001 is worth it when a large customer asks for it.

Next step