Count the devices in your business that connect to the internet. Beyond laptops and phones, the list can include the printer, the security cameras, the alarm panel, the smart TV in the meeting room, and the vehicles your team drives. Each connected device is another way into the business, which is why security belongs in your technology policy. This small business cyber security checklist sets out 10 checks you can work through in one sitting, based on the Australian Cyber Security Centre’s guidance, along with what to put in writing once you finish.
In short: A small business cyber security checklist is a list of checks that keeps your accounts, devices, data, and team protected against common attacks. It covers five areas: your accounts (MFA, access, and passphrases), your devices (updates, screen locks, and default passwords), your data (backups and privacy), your people (scam checks and an emergency plan), and your cover (cyber insurance and your IT partner).
Why do connected devices add to your cyber risk?
Each connected device is one more account, password, or update that someone has to manage, and cybercrime has a measurable cost for small businesses. Small businesses that reported cybercrime to the Australian Signals Directorate (ASD) in 2024–25 lost $56,600 per report on average, up 14% on the year before (ASD Annual Cyber Threat Report 2024–25). The most common cybercrimes businesses reported were email compromise without financial loss (19%), business email compromise fraud with financial loss (15%), and identity fraud (11%). Business email compromise is when a criminal takes over or imitates a business email account, often to send a fake invoice or a request to change bank details.
Connected devices add to that exposure. Since 4 March 2026, new consumer smart devices sold in Australia must meet mandatory security standards: no universal default passwords, a published way to report security problems, and a stated period for security updates (Herbert Smith Freehills Kramer, March 2026). Devices your business bought before then may still use a shared default password, so they belong on the checklist.
What’s on the small business cyber security checklist?
The checklist has 10 checks across accounts, devices, data, people, and cover. Work through them once a year, and again after any major change to your team or systems:
- Turn on multi-factor authentication (MFA) for email, banking, accounting, and file storage.
- Give each person access only to what their role needs.
- Use strong passphrases and remove shared logins where you can.
- Turn on automatic updates, and replace devices that no longer receive them.
- Lock down company computers with a login and an automatic screen lock.
- Change the default passwords on routers, cameras, and other connected devices.
- Back up your information regularly, keep one copy disconnected, and test a restore.
- Know what client data you hold, where it is stored, and whether the Privacy Act applies to you.
- Train your team to spot scam emails, check payment requests, and follow an emergency plan.
- Review your cyber insurance and your IT partner.
How do you secure your business accounts? (checks 1 to 3)
Secure your accounts by turning on MFA, limiting who can access what, and replacing shared logins with individual passphrases. MFA is a second check on top of a password, such as a code from an app on your phone. The ACSC’s Small Business Cyber Security Guide says to “Turn on MFA wherever possible, starting with your most important accounts.” Start with email: password-reset links for many of your other accounts arrive there.
For access, the guide says to “Ensure each user can access only what they need for their role.” Remove access as soon as someone leaves the business, and keep administrator accounts, which can change settings for everyone, to as few people as possible. Use a passphrase of several random words for each account, and replace shared logins with individual ones where the software allows.
How do you secure business computers and devices? (checks 4 to 6)
To secure business computers and devices, keep them updated, require a login and a screen lock on each one, and change any default password. The ACSC’s guide says to “Turn on automatic updates for your devices and software.” Updates fix security flaws, so a device that no longer receives updates from its maker is a device to replace.
Locking down company computers means each one needs a login, and each one locks itself when left alone. The guide says to “Configure devices to automatically lock after a short time of inactivity” and recommends security software, such as antivirus, on each device. Keep laptops and any office server where members of the public cannot reach them.
For connected devices, change any default password on the router, security cameras, alarm system, and printers, and turn off remote access you do not use. If a device no longer gets security updates, check whether it still needs to be on the network.
How should you back up and protect client data? (checks 7 and 8)
Back up your data on a schedule, keep one copy disconnected, and know which client information you hold and where. The ACSC’s guide says to “Create and implement a plan to regularly back up your information.” A case study in the guide shows why one copy should be kept disconnected: a backup drive left plugged into an infected computer was encrypted along with everything else. If your files are in the cloud, confirm who is responsible for backing them up. ASD’s cloud shared responsibility guidance recommends checking who backs up your data, how often, and whether you have tested restoring it.
For privacy, list the client and staff information you hold and where each type is stored. A business with an annual turnover of $3 million or less is generally not covered by the Privacy Act. But there are exceptions, including health service providers and businesses that trade in personal information (OAIC). Your AI policy should also say what client information stays out of AI tools.
How do you prepare your team for scams and attacks? (check 9)
Prepare your team with regular scam training, a rule for checking payment requests, and a written emergency plan. The ACSC’s guide calls employees with good cyber security practices “your first line of defence against cyber attacks.” Train the team to check any request to change bank details or pay an urgent invoice by calling the sender on a number you already have, not one in the email. The guide notes that training should be refreshed periodically, not delivered once.
That check belongs in your accounts process as well. The ACSC’s guidance on protecting against business email compromise says to “Establish a clear and consistent business process for workers to verify and validate requests for payment and sensitive information,” and it lists an unexpected change of bank details as a warning sign. A simple version of that process is a written rule that nobody updates a supplier’s bank details or pays a new payee until the request is confirmed by phone, with a second person approving the change in your banking or accounting software.
An emergency plan sets out how staff report a problem, who to call (your IT provider and your bank), and how the business keeps running if a key system goes down. Keep a printed copy, because the plan needs to work when your computers do not. To report a cyber security incident, the ACSC lists cyber.gov.au and 1300 CYBER1 (1300 292 371).
What does cyber insurance for small business cover? (check 10)
Cyber insurance for small businesses helps cover the cost of a cyber incident. According to the Insurance Council of Australia, cover generally comes in two parts. First-party cover “protects a business against the immediate expenses incurred to survive a cyber incident”, which may include business interruption, data recovery, and crisis management. Third-party cover “protects a business against liabilities to others because of a cyber-attack”, such as privacy liability and regulatory investigation costs. The Council’s February 2026 submission also notes that small business take-up of cyber insurance is understood to be low.
If you hold a policy, check what it covers, what it excludes, and whether it requires particular security controls, such as MFA, to be in place for a claim to be paid. If you do not hold one, ask a licensed insurance broker whether cover suits your business.
What should you ask your IT partner?
Ask your IT partner which checks they handle, how they monitor your systems, who tests your backups, and what an incident response costs. Many small businesses now use an outsourced IT provider, sometimes called a fractional IT provider or technology partner, for security and support. Security and privacy can feel dull, so the arrangement can go unreviewed for a long time once it is in place. A yearly review fixes that.
The ACSC’s guide recommends that you understand the security of the providers you outsource to. Ask your IT partner these questions:
- Which of the 10 checks do you handle for us, and which are our job?
- How do you monitor our devices and accounts, and how will you tell us about a problem?
- Who backs up our data, and when was a restore last tested?
- How quickly do you respond to an incident, and what does that response cost?
What should go in your IT security policy?
Record the results of the checklist in the security section of your IT policy, so the next review starts from what you found. Include:
-
- which accounts have MFA, and who has administrator access
-
- the update and backup schedule, and where the disconnected backup is kept
-
- a list of devices, including connected devices, and their default-password status
-
- what client data you hold, where it is stored, and what stays out of AI tools
-
- your payment-checking rule for bank detail changes and new payees
-
- the emergency plan, with phone numbers
-
- your cyber insurance details and your IT partner’s contact details
-
- the date of the next review
If you still run an office server, see Cloud vs On-Premise Server: What Suits a Small Business?
FAQ
What should a small business cyber security checklist include?
A small business cyber security checklist should cover account security (MFA, access, and passwords), device security (updates, screen locks, and connected devices), data (backups and privacy), people (training, payment checks, and an emergency plan), and cover (cyber insurance and your IT partner). The ACSC’s Small Business Cyber Security Guide is a reliable source for the core steps.
How often should a small business review its cyber security?
Run the full checklist at least once a year. Review the relevant checks again when someone joins or leaves, when you add a system or device, when you change IT provider, or when you move premises. The ACSC recommends refreshing staff training periodically rather than treating it as a one-off.
Do small businesses need cyber insurance?
Cyber insurance is not compulsory for small businesses, and whether it suits yours depends on the data you hold and how much your business relies on its systems. Cover generally includes first-party costs, such as recovering data, and third-party liabilities, such as privacy claims. A licensed insurance broker can explain the options.
How do I secure business computers?
Turn on automatic updates, require a login on every computer, set screens to lock automatically after a short time, and install security software. Turn on MFA for the accounts used on each computer, and give each person access only to what their role needs. Replace computers that no longer receive security updates.
How do I stop business email compromise fraud?
Set a written rule that any request to change bank details or pay a new payee is confirmed by phone, using a number you already hold, before anyone acts on it. The ACSC advises a clear and consistent process for checking payment requests. Turn on MFA for email, and train your team to spot unexpected requests.
Who do I contact after a cyber attack?
Follow your emergency plan. If money has been sent or bank details changed, contact your bank first. Then contact your IT provider and report the incident to the Australian Cyber Security Centre through cyber.gov.au or 1300 CYBER1 (1300 292 371). If personal information is involved, ask your adviser whether you have privacy obligations.
Book an hour to run the checklist
A small business cyber security checklist works when it is used. Book an hour this month, work through the 10 checks with your IT partner, and record the results in your IT policy. Start with check 1: turn on MFA for your email today.
Insurance, privacy, and legal obligations depend on your business, so raise them with your insurance broker, accountant, or legal adviser before relying on any one rule.
To check that your security spending, cyber insurance, and payment controls fit your budget and cash flow, book a call with Sky Accountants.