Cyber Security Checklist for Australian Small Business 2026

Australian small businesses suffered more than 43,000 cybercrime reports to the ACSC in the 2024-25 financial year — and the average cost per incident for a small business exceeded $49,000. This checklist gives you the controls that actually reduce that risk, presented in the order you should implement them.

This is a practitioner-to-practitioner document. It assumes you are the person responsible for IT in your business — whether that is your role, or it has simply landed in your lap. It does not assume a dedicated security team or a large budget.

Before you work through the checklist, take the free SMB cyber security assessment at /smb-cyber-security. It takes under 15 minutes and gives you a scored baseline so you know precisely which sections below need the most attention.

How to Use This Checklist

For each item, assign one of three statuses:

• Done — the control is fully implemented and consistently applied
• Partial — the control exists but is not applied to all users, devices, or systems
• Not done — the control is absent

At the end of each section, count your gaps. Use the output to build a remediation register: one row per gap, with a responsible person and a target completion date. A checklist without a follow-up action plan is just paperwork.

Section 1: Identity and Access

Identity is the new perimeter. Most breaches in 2026 begin with a compromised credential, not a technical exploit.

1.1 Multi-Factor Authentication

1. Enable MFA on every Microsoft 365 or Google Workspace account — including shared mailboxes and service accounts
2. Enable MFA on your banking and financial services portals
3. Enable MFA on your accounting software (Xero, MYOB, QuickBooks)
4. Enable MFA on any cloud storage service (SharePoint, OneDrive, Dropbox, Google Drive)
5. Enable MFA on your domain registrar and DNS host — these are high-value targets
6. Verify that MFA cannot be bypassed using legacy authentication protocols (in Microsoft 365, block legacy auth under Security Defaults or a Conditional Access policy)

Priority: Highest. If you do nothing else this week, do this.

1.2 Password Management

7. Deploy a business password manager (1Password, Bitwarden, or Keeper are commonly used in Australian SMBs)
8. Require unique passwords for every account — no shared or reused passwords
9. Remove all default credentials from routers, printers, NAS devices, and IP cameras
10. Audit and remove accounts for former staff — check Microsoft 365, accounting software, and any shared systems

1.3 Privileged Access

11. Ensure staff log in with standard accounts for day-to-day work — only use administrator accounts when specifically needed for administrative tasks
12. If you use Microsoft 365, assign global administrator roles only to dedicated admin accounts that are not used for email

Section 2: Patching and Updates

Unpatched software is the most consistently exploited attack surface for Australian SMBs.

2.1 Operating System Patching

13. Enable automatic updates on all Windows and macOS devices
14. Verify that updates are actually being applied — open Windows Update or Software Update on each device and confirm the last install date is within the past two weeks
15. Remove or replace any device running an operating system that no longer receives security updates (Windows 10 reaches end of life in October 2025; any device still running it is unpatched)

2.2 Application Patching

16. Enable automatic updates in all browsers (Chrome, Edge, Firefox, Safari)
17. Update Microsoft Office or Microsoft 365 Apps at least monthly — enable automatic updates in the Microsoft 365 Admin Centre
18. Update Adobe Acrobat Reader, Adobe Creative Suite, and any other productivity software
19. Update any line-of-business software — contact your vendor if automatic updates are not available
20. Patch your router firmware — log in to the administration interface and check the firmware version against the manufacturer's current release

2.3 Mobile Devices

21. Enable automatic updates on all iOS and Android devices used for work
22. Require a minimum PIN or biometric lock on all work mobile devices
23. Enrol work devices in a mobile device management (MDM) solution if more than three staff use mobile devices for work — Microsoft Intune is included in Microsoft 365 Business Premium

Section 3: Email and Phishing Protection

Phishing is the most common initial access vector used against Australian small businesses.

3.1 Email Security Configuration

24. Enable Microsoft Defender for Office 365 (if on Business Premium or equivalent) — this adds anti-phishing, safe links, and safe attachments policies
25. Verify your domain has a valid SPF record published in DNS
26. Publish a DKIM record for your domain — in Microsoft 365, enable DKIM signing in the Defender portal under Email Authentication
27. Publish a DMARC record set to at minimum p=none with a reporting address — this tells you who is sending email from your domain without your authorisation
28. Block macro execution in Microsoft Office documents received from the internet (see Section 5)

3.2 Staff Phishing Awareness

29. Train all staff to verify unexpected requests for payment, credential resets, or sensitive data by calling the requester on a known number — never reply to the suspicious email
30. Run at least one simulated phishing test per year — Microsoft Attack Simulator is included in Microsoft 365 Business Premium

Section 4: Backups

Ransomware works because organisations either have no backups or have backups that are also encrypted in the attack.

4.1 Backup Coverage

31. Identify every system and data store that contains data your business cannot operate without — accounting data, client records, contracts, emails, and configuration files
32. Confirm that all identified data is included in your backup scope
33. Ensure backups run at minimum daily for critical data

4.2 Backup Isolation

34. Confirm that your backup destination is not accessible from the same credentials as your production environment — an attacker with access to your Microsoft 365 tenant should not also have delete access to your backup storage
35. Use a separate cloud account, an offline device, or an immutable cloud backup service (such as Backblaze B2 with Object Lock, or Azure Blob with immutability policy)

4.3 Backup Verification

36. Restore a test file from your backup at least quarterly — a backup you have never tested is not a backup you can rely on
37. Document the date of your last verified restoration
38. Test a full system restoration scenario at least annually — partial file restoration tests are not sufficient to confirm you can recover from ransomware

Section 5: Application Control and Macro Management

5.1 Microsoft Office Macros

39. In Microsoft 365 Apps for Business, set the default macro policy to block macros from the internet: open Group Policy or the Microsoft 365 Apps admin settings and enable "Block macros from running in Office files from the Internet"
40. If staff legitimately need macros, sign trusted macros with a digital certificate and allow only signed macros to run
41. Audit existing macro-enabled files (.xlsm, .docm, .xlam) and remove any that are not actively used

5.2 Software Installation Control

42. Remove local administrator rights from standard user accounts — staff should not be able to install software without approval
43. Maintain a list of approved applications and investigate any software installed outside that list

Section 6: Network Security

6.1 Router and Wi-Fi

44. Change the default admin password on your router to a unique, strong password stored in your password manager
45. Ensure your Wi-Fi network uses WPA3 or WPA2 encryption — WEP is broken and must not be used
46. Create a separate guest Wi-Fi network for visitors, client devices, and IoT equipment — do not give guests access to your business network
47. Disable remote management on your router unless you have a specific operational requirement for it
48. Review any port forwarding rules configured on your router and remove any that are no longer needed

6.2 Remote Access

49. If staff access systems remotely, use a VPN or Microsoft Entra ID Conditional Access rather than exposing Remote Desktop (RDP) directly to the internet — exposed RDP is actively exploited
50. Ensure all remote access uses MFA (covered in Section 1, but confirm it applies to VPN and remote desktop sessions specifically)

Section 7: Incident Preparedness

51. Identify who is responsible for responding to a cyber incident in your organisation — this should be a named person, not "IT"
52. Document the contact details for your internet service provider, Microsoft support, your managed service provider (if applicable), and the ACSC ReportCyber portal (cyber.gov.au/report)
53. Review your cyber liability insurance policy — confirm it covers ransomware, business interruption, and notification costs
54. Know your notification obligations: if your business holds personal information for more than 5,000 Australians or annual revenue exceeds $3 million, you are likely subject to the Notifiable Data Breaches scheme under the Privacy Act 1988 — a breach may require notification to the OAIC within 30 days

Scoring Your Results

Count your items in each status category per section and calculate a completion percentage. Use this to prioritise:

• Under 50 percent complete in Sections 1 or 4: Address identity and backup gaps this week — these represent the highest probability of a significant financial loss
• 50-75 percent complete overall: You have a foundation; focus the next 30 days on closing patching and email security gaps
• Above 75 percent complete: Validate your controls technically rather than just administratively — review logs, test your backup restoration, and run a phishing simulation

For a scored assessment that compares your results against other Australian SMBs, complete the free SMB cyber security assessment. It produces a written report you can share with your leadership team or board.

For the broader strategic context behind these controls, the practical baseline guide for Australian small business covers why each control matters and how to make the business case internally.

Next Steps

A checklist is a point-in-time snapshot. Convert your findings into a living remediation register by capturing each gap as a task with a responsible owner, a target date, and a verification method. Review the register monthly until all high-priority items are closed, then quarterly thereafter.

If you need help prioritising or implementing the controls identified in this checklist, start with a free assessment to get a structured report and prioritised recommendations tailored to your environment.