Cyber Security Baseline for Australian Small Business (2026)

A practical cyber security baseline you can finish this week

The cyber security baseline an Australian small business needs in 2026 is shorter than the industry suggests. The Australian Cyber Security Centre (ACSC), business.gov.au, the Office of the Australian Information Commissioner (OAIC), and every mainstream cyber insurer agree on roughly the same dozen controls.

This guide explains those controls in plain English. It points you at the free Australian resources for each one, and shows what your cyber insurer will ask at renewal. It is written for owners, office managers, and operations leads, not security engineers.

The shape of the baseline is simple. Three quick wins from the ACSC cover most attacks. A handful of supporting controls cover your obligations under the Privacy Act 1988 (Cth). (Office of the Australian Information Commissioner — the Privacy Act, accessed 16 June 2026) A short list of evidence items covers your cyber insurance renewal. Everything else is a step up from the baseline once you have these in place.

Why small business cyber matters in Australia in 2026

Small businesses are increasingly targeted by cybercriminals, and simple steps can significantly reduce the risk. That is how the ACSC Small Business Cyber Security Guide (current edition, updated late 2025) opens. The framing matters. Most Australian small business incidents in the ACSC published case notes were not sophisticated. They were preventable with controls already free to every business.

The ACSC annual reporting shows ransomware, business email compromise, and invoice fraud as the three most common incident types for Australian small businesses. The average reported cost of an incident sits in the tens of thousands of dollars, before downtime, customer loss, and legal advice. Australian Small Business and Family Enterprise Ombudsman (ASBFEO) 2025 guidance notes a tightening of cyber insurance underwriting. Small businesses without basic controls now find cover declined, priced punitively, or limited to small sub-limits.

There is a regulatory layer as well. Under the Privacy Act 1988 (Cth), the OAIC operates the Notifiable Data Breaches (NDB) scheme. (Office of the Australian Information Commissioner — Notifiable Data Breaches scheme, accessed 16 June 2026) Most small businesses that handle personal information are covered, and the scheme imposes a thirty-day assessment window from the moment a suspected breach is identified. OAIC determinations published in early 2026 confirm that breaches caused by suppliers sit with the contracting business, not the supplier. Your suppliers' security posture is now part of your own.

The ACSC three quick wins explained

The ACSC's Small Business Cyber Security Guide leads with three priority controls. If you do nothing else, do these three.

1. Turn on multi-factor authentication

Multi-factor authentication (MFA) means that signing in needs more than just a password — usually a code, app prompt, or hardware key as well. The ACSC and every Australian cyber insurer expect MFA at minimum on:

• Your email accounts (Microsoft 365, Google Workspace, Xero, MYOB).
• Your admin accounts for those services.
• Your accounting and banking platforms.
• Your remote access to office systems.

Microsoft Learn documents (current 2026 guidance) describe the two practical paths for small businesses: Microsoft 365 Security Defaults, which turns MFA on for everyone in your tenant with one toggle, or a Conditional Access policy if you have Business Premium. (Microsoft Learn — Conditional Access overview, accessed 16 June 2026) Google Workspace has an equivalent "2-Step Verification enforcement" switch. Both take under thirty minutes to configure end-to-end.

The ACSC and insurers prefer authenticator app prompts or hardware passkeys over SMS. SMS-based MFA can be defeated by SIM-swap attacks. (Australian Cyber Security Centre — Implementing multi-factor authentication, accessed 16 June 2026) If you are choosing where to start, the Microsoft Authenticator or Google Authenticator app is free and works on any phone.

2. Keep systems and software up to date

Most small business breaches in the ACSC case notes start with a vulnerability that had a patch available, sometimes for months. The fix is to turn on automatic updates everywhere:

• Windows Update on every desktop and laptop, set to install security updates automatically.
• macOS automatic updates on every Mac.
• Microsoft 365 Apps and Adobe Acrobat set to update automatically.
• Your accounting and CRM cloud apps update themselves — confirm by signing in to admin and checking last release dates.
• Routers, network switches, and wireless access points need firmware updates too — many small businesses miss this entirely.

ACSC Essential Eight Maturity Level 1 (Maturity Model, November 2025 ISM revision) sets a thirty-day window for security patches and a forty-eight-hour window for extreme-risk vulnerabilities. (Australian Cyber Security Centre — Essential Eight maturity model, accessed 16 June 2026) For a small business, the practical translation is simple: turn on automatic updates everywhere, then check once a quarter that they ran. If your IT provider manages your devices via Microsoft Intune, ask for the monthly patch compliance report. That report is also the evidence your insurer will want.

3. Take regular backups — and keep one offline

Backup is the control that makes ransomware survivable. The ACSC small business guidance is clear: backups should be regular, restorable, and kept where ransomware cannot encrypt them.

The "offline or immutable" requirement is the part most small businesses miss. If your backup lives in the same cloud account as your live data, modern ransomware will encrypt both in the same minute. Three patterns work for small business in Australia in 2026:

• Microsoft 365 Backup (Microsoft's first-party backup service for Exchange, SharePoint, and OneDrive) configured with immutability. This is the simplest option for businesses already on Microsoft 365 Business Premium or above.
• A reputable third-party SaaS backup provider with documented immutability — Datto, Veeam, AvePoint, Backupify all serve the Australian SMB market.
• A rotating offline copy of file shares to an external drive, physically removed and stored elsewhere after each backup cycle.

Whichever pattern you choose, the ACSC and your cyber insurer will both ask whether you have tested a restore in the last twelve months. An untested backup is a hope, not a plan. Pick one mailbox and one file folder, restore them to a test location, and write down what you saw. That note is the evidence your insurer wants.

Notifiable Data Breaches — your reporting obligations

The OAIC Notifiable Data Breaches scheme (operational since 2018 under the Privacy Act 1988 (Cth)) imposes a real obligation on most Australian small businesses, even though many owners are unaware of it. Coverage applies if any of the following are true:

• Annual turnover above AUD 3 million.
• You handle health information (allied health, optometry, dental, allied wellness, pharmacy, fitness with health intake forms).
• You provide services under a Commonwealth contract.
• You trade in personal information.
• You are a credit provider, credit reporting body, or related entity.
• You are a TFN recipient.

Many small businesses are covered regardless of turnover: most allied health, most legal practices, most not-for-profits with donor data, and most professional services. The OAIC publishes a self-assessment tool at oaic.gov.au. Complete it once and document the result.

When a breach happens, the obligation is to:

1. Contain the breach — limit further loss of data.
2. Assess within thirty days whether the breach is likely to result in serious harm.
3. If serious harm is likely, notify the OAIC and affected individuals as soon as practicable.

The thirty-day assessment clock starts when you become aware of a suspected breach, not when you confirm it. OAIC determinations in early 2026 reinforced that delayed notification is itself a compliance failure. So you need an incident plan ready before an incident happens. The cheapest version is a one-page document covering who to call, what to write down, and how long you have. The ACSC publishes a template at cyber.gov.au, and business.gov.au reproduces it in plain language.

Cyber insurance underwriting in 2026 — what insurers actually ask

ASBFEO 2025 cyber resilience guidance and 2026 underwriting questionnaires from major Australian SMB insurers (Chubb, AIG, Coalition, CGU, BizCover-distributed products) ask broadly the same questions. The current minimum bar in 2026:

• MFA on email and admin accounts — non-negotiable. Missing MFA is the single most common reason cover is declined or repriced.
• Patching cadence — automatic updates enabled, monthly compliance check.
• Endpoint protection — a business-grade EDR product, not free consumer antivirus. Microsoft Defender for Business (bundled with Microsoft 365 Business Premium) qualifies.
• Email security — SPF, DKIM, and DMARC configured. DMARC at p=quarantine or p=reject is increasingly required, not optional.
• Backups — offline or immutable, with a tested restore in the last twelve months.
• Incident response plan — documented, with contact details for IT, insurer, OAIC, and the Australian Cyber Security Hotline (1300 CYBER1).
• Supplier security — written expectations of suppliers who hold or process your customer data.
• Awareness training — annual training for all staff. Cyber Wardens satisfies this for most underwriters.

Across all the insurance forms, the pattern is the same: they ask for evidence, not opinion. You will need screenshots of MFA enforcement, exported patch compliance reports, a written incident plan, and an attestation of training. The free Small Business Cyber Security Assessment from EDUC4TE produces this evidence list directly. You can also assemble it yourself by working through the ACSC small business guide checklist.

Supplier risk — your suppliers' breaches are your problem

OAIC determinations published in early 2026 made the supplier-chain expectation explicit. If your bookkeeper, accountant, IT provider, or CRM vendor suffers a breach that includes your customer data, the OAIC holds you, the contracting business, responsible for the NDB notification. Insurance contracts follow the same logic.

The practical control set is short:

• Maintain a list of every supplier that holds your customer or staff data. Most small businesses have between five and fifteen.
• Issue a one-page security expectations document to each — MFA, encryption in transit, breach notification within twenty-four hours.
• Confirm annually that the supplier still meets those expectations. An email exchange is sufficient evidence.

ASBFEO guidance (2025 refresh) reinforces that this supplier attestation pattern is now standard practice. Many enterprise customers already require it from their small business suppliers too.

Australian-specific resources for free

Every control in this baseline has a free Australian source. You need nothing beyond your normal IT subscriptions to implement it.

• ACSC Small Business Cyber Security Guide — cyber.gov.au. The authoritative baseline document, updated late 2025. Includes printable checklists and an incident response template.
• business.gov.au cyber security for business — plain-English commentary on the ACSC controls plus the Notifiable Data Breaches obligations and the Australian Cyber Security Hotline number (1300 CYBER1).
• OAIC Notifiable Data Breaches scheme — oaic.gov.au. Includes the coverage self-assessment tool and the published determinations that explain how the scheme is applied in practice. The OAIC also publishes the Australian Privacy Principles, of which APP 11 covers security of personal information. (Office of the Australian Information Commissioner — Australian Privacy Principles, accessed 16 June 2026)
• Cyber Wardens — cyberwardens.com.au. Free ASBFEO and CommBank-backed awareness training, about forty-five minutes per person. One of the best ways to lift staff phishing resilience in a small business.
• ASBFEO cyber resilience guidance — asbfeo.gov.au. Focused on supplier-chain attestation and cyber insurance access for small business.
• Australian Cyber Security Hotline — 1300 CYBER1. Free, 24/7. Print this number on the back of every contact card.

A one-week implementation plan for a typical small business

If you are starting from scratch, this is the order that fits a single working week with no specialist tooling.

Monday — identity (about 2 hours). Turn on Microsoft 365 Security Defaults or Google 2-Step Verification enforcement. Create separate admin accounts for anyone with admin rights and remove admin rights from daily-use accounts.

Tuesday — updates (about 2 hours). Confirm Windows Update is enabled on every device. Confirm Microsoft 365 Apps auto-updates. Update router firmware. Sign in to your accounting, CRM, and other SaaS admin pages and confirm last-release dates.

Wednesday — endpoint and email (about 2 hours). Deploy Microsoft Defender for Business or your existing EDR to every device. Publish SPF, DKIM, and DMARC for your email domain. Set DMARC at p=quarantine to start.

Thursday — backup and recovery (about 3 hours). Enable Microsoft 365 Backup with immutability, or configure your third-party SaaS backup with documented immutability. Pick one mailbox and one folder and run a test restore. Write down what happened.

Friday — people and process (about 3 hours). Enrol every staff member in Cyber Wardens. Draft a one-page incident response plan from the ACSC template. Print an A5 incident contact card with insurer, IT provider, OAIC, and 1300 CYBER1 phone numbers. Issue your one-page supplier expectations document to each supplier holding your customer data.

By the end of that week you have done more than most Australian small businesses, satisfied the ACSC baseline, and assembled most of the evidence your cyber insurer will ask for at renewal.

Related guides in this series

Each control in this baseline has a dedicated companion guide. Read them in any order:

• Notifiable Data Breaches in plain English — who is covered, the thirty-day clock, and what to do when a breach happens.
• Cyber insurance underwriting questions answered — the eight question themes Australian insurers ask in 2026 and the evidence each needs.
• MFA for tiny teams — turning on multi-factor authentication across Microsoft 365, Google Workspace, Xero, and MYOB.
• Backup that survives ransomware — immutability, offline copies, and restore testing.
• SMB cyber insurance evidence pack template — a downloadable pack that assembles the evidence underwriters request.

Where to go from here

To confirm where you sit against this baseline, the EDUC4TE Small Business Cyber Security Assessment scores you in five minutes against the same ACSC and insurance-underwriter controls described in this guide. It is free, requires no account, and produces an evidence list you can take into your next insurance renewal conversation. For a deeper look, the practitioner-led assessment service reviews your actual Microsoft 365 or Google Workspace configuration and produces a budget-tiered remediation plan using the same framework.

Whether you self-assess or engage a practitioner, the message of this guide matches what the ACSC has repeated since 2020. Most attacks on small business are preventable. The controls are free or already in your existing subscriptions. The gap between "vulnerable" and "resilient" is usually one working week of focused effort.

Sources referenced in this article: Australian Cyber Security Centre (Small Business Cyber Security Guide, Essential Eight Maturity Model, Implementing Multi-Factor Authentication); Office of the Australian Information Commissioner (Privacy Act 1988, Notifiable Data Breaches scheme, Australian Privacy Principles); Microsoft Learn (Conditional Access); business.gov.au; Cyber Wardens (ASBFEO and Commonwealth Bank); Australian Small Business and Family Enterprise Ombudsman.