Just tell me what to actually do to protect my business

The Australian government baseline for cyber security. Eight practical things every business should do: MFA, patching, backups, restricting admin access, and so on. Insurers and bigger customers will ask if you are doing it. ASD is evolving it into a new Essentials series over the next two years, but the eight strategies stay the same and it remains current guidance. Start here.

An Australian cyber security certificate built specifically for small and medium businesses. Five tiers from Bronze to Diamond. Gold is the sweet spot for most SMEs. It is the easiest way to prove to insurers, customers and primes that you actually do the basics.

Australian law. If personal information leaks and people could be seriously harmed, you must notify the OAIC and the people affected. Applies to most businesses turning over $3M+ and plenty of smaller ones (health, childcare, contractors handling personal data). Not optional.

International information security standard. Heavy on documentation and expensive to certify (think tens of thousands of dollars). Worth it if a multinational customer or large tender requires it. For most SMEs, SMB1001 Gold covers the same ground for a fraction of the cost.

The full Australian government cyber security rulebook (hundreds of pages). Mostly relevant if you sell to government, work in Defence supply chain, or run critical infrastructure. Almost no SMEs need to read this cover to cover.

American cyber security frameworks. Sometimes used as a shared language with US-based customers or parent companies. If you are doing the Essential Eight properly, you are already covering most of what NIST and CIS ask for. Do not chase them just because someone mentioned them.

A US Department of Defense requirement. Only matters if you supply into the American defence industry. If that is not you, ignore it completely.

Australian critical infrastructure law. Covers energy, water, telco, transport, food, healthcare, education and designated mining assets. If this applies, your obligations are far beyond the SMB baseline and you need specialist help, not a checklist.

Microsoft 365 Business Premium with proper backup, MFA, EDR, monitored patching and a real human to call. This is the floor for an Australian business that takes itself seriously.

Everything above plus 24/7 monitoring (SOC), incident response, identity hardening, security awareness training, documented policies and quarterly reviews.

You keep your IT person or team. We bring the security operations centre, after-hours cover, vCISO advisory and the parts no SMB can hire for.

Is this enough to be "secure"?

Nothing makes a business 100% secure. Doing the items in this guide puts you ahead of roughly 80% of Australian small and mid-sized businesses, defends against most automated attacks, and gives you a real chance of recovering when something does happen. That is what good looks like for an SMB.

Can we just do this ourselves?

You can do most of it yourself if you have the time, the discipline, and at least one technical person who actually owns it. Where most businesses come unstuck is the day-to-day: someone has to keep MFA enforced when staff change, test backups, review admin access, run patching, and respond to alerts at 11pm. That is what an MSP does.

We are 5 people. Do we really need all this?

Yes, but the version sized for 5 people is much smaller and cheaper than the version sized for 50. MFA, business email, backup, patching, EDR and a password manager are non-negotiable at any size. Everything else scales with headcount and risk.

My nephew/cousin/mate "does IT". Is that fine?

For setting up a printer, yes. For protecting the business from ransomware, business email compromise and notifiable data breaches under the Privacy Act, no. Cyber security in 2026 is not a part-time job. If something goes wrong, you need a documented chain of accountability, an insurer who will pay out, and someone you can sue if needed.