Australia’s New Small Business Cyber Security Handbook: 7 Checks to Make This Week

SwiftTech Weekly Cybersecurity Update | 12 October 2026

Cybersecurity advice can sound complicated, especially when you are busy running a business. This week, the Australian Government has made it easier to know where to start.

On 7 October 2026, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published its Small business cyber security handbook. It is aimed at owners, managers and staff, not just IT specialists.

The handbook highlights three starting points: multi-factor authentication, software updates and backups. It also covers email scams, staff awareness, remote work, access controls, incident response and using AI securely.

Here is how to turn it into a manageable plan.

Why this matters to a small business

Imagine losing access to your email on a Monday morning. You cannot confirm customer bookings, receive invoices or send quotes. Then a supplier calls to ask why you requested a change to their bank details — something you never did.

Criminals often look for exposed systems, weak passwords and opportunities to trick someone into sending money. The ACSC’s handbook is useful because it focuses on practical controls rather than expensive technology for its own sake.

1. Put multi-factor authentication on important accounts

Multi-factor authentication (MFA) asks for another form of proof when someone signs in. For example, a password might be followed by approval in an authenticator app. If a password is stolen, that extra check can help prevent an intruder from getting in.

Start with business email, Microsoft 365, accounting systems, remote access, website administration and any account that can change payments or security settings. Use a unique password for every account, preferably stored in a reputable password manager. Where supported, consider passkeys or phishing-resistant MFA for important accounts.

Ask your IT provider to check that it is properly enforced, including on administrator accounts and older sign-in methods. Our SwiftTech cybersecurity services can help review these settings.

2. Check that updates are actually happening

Updates do more than add features. They often repair security weaknesses that attackers can use to enter a computer, server, router or application.

Make a list of the devices and software your business relies on: Windows PCs, Macs, phones, firewalls, Wi-Fi equipment, printers, websites and business applications. Find out who is responsible for updating each one. Set automatic updates where appropriate, but do not stop there. Some updates need a restart, some network devices require manual attention, and older equipment may no longer receive security fixes. The ACSC’s small business handbook specifically recommends installing security updates as they become available.

3. Back up your data — then prove you can restore it

A backup is only helpful if it contains the right information and can be restored when needed.

Decide how often it must be backed up and how quickly you need it back after an incident.

Keep protected backup copies separate from day-to-day systems so that one compromised account cannot easily destroy everything. Monitor failed backup jobs and arrange regular test restores. For Microsoft 365, check what is covered by your existing retention and recovery arrangements; do not assume every mailbox or file is protected by an independent backup.

Ask one simple question: “When did we last restore a file or a whole system successfully?” If nobody knows, a recovery test should be on your list. SwiftTech’s data protection and backup services focus on recoverability, not just creating copies.

4. Make invoice and bank-detail changes harder to fake

A convincing email can still be a scam, even if it appears to come from a supplier you know. Criminals may gain access to a genuine mailbox or impersonate a business to send false invoices and changed payment details.

The ACSC’s business email compromise guidance recommends clear verification processes. Before paying to a new bank account, call the supplier using a phone number you already trust — not the number in the email requesting the change.

For larger payments, consider having a second staff member approve the transaction. A short, consistent process can protect the business even when a scam message looks professional.

5. Review the office network and remote access

Your Wi-Fi and internet router are part of your business security, not just the equipment that makes the internet work.

Check that default administrator passwords have been changed, firmware is supported and updated, and remote management is restricted. Use secure Wi-Fi settings, give guests a separate network and avoid connecting untrusted devices to the same network as business systems.

Remove unused VPN accounts and remote-access tools. Make sure remote access is protected by MFA wherever supported.

A network security review can identify old equipment, unnecessary internet exposure and configuration gaps before they cause trouble.

6. Give staff the access they need — and no more

A receptionist, bookkeeper and business owner do not all need the same permissions. Limiting access reduces the damage that a stolen account or accidental change can cause.

Review who can see customer records, change bank details, install software and administer Microsoft 365. Remove access promptly when someone leaves, and check that former contractors no longer have active accounts or shared passwords.

If your team is beginning to use AI assistants, also review what business data and connected applications those tools can access. The ACSC handbook includes guidance on using AI securely; ordinary access rules still matter when a software assistant is doing the work.

Businesses wanting a more structured approach can use the ACSC’s Essential Eight as a longer-term guide, with help from SwiftTech’s Essential Eight services.

7. Write down what to do when something goes wrong

Create a short incident plan with the contact details for your IT provider, insurer, bank and key decision-makers. Keep a copy of the plan somewhere accessible if your usual email and files are unavailable.

Practise one scenario: a staff member reports a suspicious login or a fraudulent invoice. Who receives the report? Who checks whether the account was accessed? Who calls the bank if money has moved?

If you suspect a serious incident, seek help promptly. The ACSC provides guidance and can be contacted on 1300 CYBER1 (1300 292 371). Do not erase potentially useful logs or rush into rebuilding affected systems before getting appropriate advice.

A practical one-week plan

You do not need to do everything in one afternoon. Start with the highest-impact gaps.

Monday: confirm MFA is enforced on business email and administrator accounts. Tuesday: check whether devices and internet-facing equipment are patched. Wednesday: ask for the latest successful backup and restore-test results. Thursday: introduce a phone verification rule for changed bank details. Friday: review staff access and record who to call during an incident.

For a quick starting point, try the ACSC’s free, anonymous Cyber Health Check Tool for small businesses and not-for-profits.

Related SwiftTech services

• Cybersecurity and IT security
• Data protection, backup and recovery
• Network infrastructure and Wi-Fi security
• Essential Eight security reviews
• Business IT support and managed services

Authoritative references

• ASD’s ACSC — Small business cyber security handbook (7 October 2026)
• ASD’s ACSC — Protecting against business email compromise
• ASD’s ACSC — Cyber Health Check Tool
• ASD’s ACSC — Essential Eight