At a glance
These how-to guides provide practical, step-by-step advice to help small businesses improve their cyber security using Apple, Google and Microsoft devices and accounts. They cover simple actions that can help protect business information, secure online accounts and reduce common cyber security risks. This guidance is for small business owners and staff with any level of technical expertise. Choose the guide that matches your device or operating system and follow the recommended actions to strengthen your cyber security.
Key actions
Turn on multi-factor authentication to make it harder for cybercriminals to access your accounts.
Use strong, unique passwords and store them in a password manager.
Keep your devices and software up to date by turning on automatic updates.
Back up your important business data regularly so you can recover quickly if something goes wrong.
Protect your small business
Follow a list of clear actions to help protect your Apple, Google and Microsoft devices and accounts.
Use the guide for your device or operating system.
A ‘how to’ guide for Apple keyboard_arrow_down
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has prepared, in consultation with Apple, this guidance for small businesses that use Apple operating systems, such as macOS and iOS.
Secure your devices and accounts
To unlock your device on iOS and iPadOS, use the strongest built-in security available such as Face ID, Touch ID or Optic ID. For accounts using a traditional password, make it long, complex and unique:
- at least 15 characters in length
- some capital letters, symbols and numbers
- a passphrase (4 or more unrelated words)
- one that is not used on any other account.
Consider running a Safety Check on your Apple iPhone (iOS 16+) for recommended actions.
Use multi-factor authentication
Multi-factor authentication (MFA) adds an extra layer of security to your accounts by requiring two or more different methods to verify your identity. Apple refers to MFA as two-factor authentication.
Options (where supported) include:
- password and code
- Security Keys.
Use MFA whenever it is available, and choose non-phishable MFA like passkeys or hardwarebound security keys, if possible.
Use a password manager
A password manager helps you store, manage and create complex passwords. ASD recommends the use of a standalone password manager. Apple offers password management integrated across your devices with the Passwords App and iCloud Keychain.
The built-in Passwords App can warn you of known password re-use, or weak passwords, as well letting you know if a password has appeared in a known breach.
Apply software updates
Turn on automatic updates. This will ensure security fixes are installed early (on supported devices) and keep your device more protected. Go to:
- Settings (System Settings for macOS)
- General (for iOS/iPadOS), then Software Update
- Turn on Automatic Updates
You should also enable automatic updates on apps from the Apple App Store and only download from reputable developers.
Manage antivirus software
Apple offers XProtect, as its built-in antivirus software for macOS. By default, XProtect updates itself automatically, ensuring your Mac is guarded against the latest threats.
Products such as iPhones and iPads do not have dedicated antivirus software. Instead, Apple’s iOS is designed with security as a core principle, making it less vulnerable to traditional viruses and malware.
Back up your data
There are three backup options offered by Apple:
- iCloud (all devices)
- Local Backup to a computer (iOS and iPadOS)
- Time Machine (macOS)
Automatic iCloud backups run when your device is connected to Wi-Fi, charging and locked. Go to:
- Settings (System Settings for macOS)
- Apple Account (or your profile), then go to iCloud
You can also back up your iPhone or iPad to your Mac or Windows computer.
Apple devices running macOS can also use Time Machine which stores backups and system recovery images to an external hard drive or USB.
Go to: Settings, then General, and finally Time Machine
A ‘how to’ guide for Google keyboard_arrow_down
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has prepared, in consultation with Google, this guidance for small businesses that use Google devices running on Chrome OS or Android OS.
Secure your devices and accounts
Use the strongest security available on your Google device, such as a passcode (PIN) combined with biometrics.
For accounts using a traditional password, make it long, complex and unique. Use:
- at least 15 characters in length
- some capital letters, symbols and numbers
- a passphrase (4 or more unrelated words)
- one that is not used on any other account.
Use multi-factor authentication
Multi-factor authentication (MFA) adds an extra layer of security to your accounts by requiring two or more different methods to verify your identity.
Google offers MFA across devices running Chrome OS and Android OS, including:
- Google Authenticator app
- Passkeys (face scan, fingerprint or PIN)
- Titan Security Key.
Hardware security keys and biometrics are typically the most secure MFA methods, while SMS and email are less so.
For more security options, enrol in Google’s Advanced Protection Program.
Use a password manager
A password manager helps you store, manage and create complex passwords. ASD recommends the use of a standalone password manager.
Use a different password manager for your business accounts and keep your personal accounts separate.
Google offers a free password manager called Google Password Manager built into the Chrome web browser and Android devices.
Apply software updates
Most Google operating systems, such as Android or ChromeOS and other applications, automatically update or will prompt the user if there are updates available.
To improve your cyber security, apply updates as soon as you are notified.
If you are using an older device running Android, check if there is a newer version available – the latest versions of Android are more secure. Go to:
- your device’s Settings app
- System or About Phone
- Check for software updates
Manage antivirus software
Google offers several security protections for users, depending on which device and software is used.
For Android, Google Play Protect is built-in and automatically scans to help disable any malware or harmful apps found.
Other products, such as Google Messages and Gmail also have built-in spam and phishing protections.
Google’s Security Check-up also helps you find added protection. Sign into your Google account and go to:
- My Account, then Security Check-up
- review the recommendations and follow the steps.
Back up your data
Google offers a variety of backup options, including:
- Google Drive which provides cloud storage and file sync
- Google One which enhances this with more space across Drive and Gmail
- Google Workspace which integrates Google Drive with essential business tools, providing robust cloud storage and built-in automatic backups.
A ‘how to’ guide for Microsoft keyboard_arrow_down
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has prepared, in consultation with Microsoft, this guidance for small businesses who use Microsoft Windows.
Secure your devices and accounts
Use the strongest security available, such as Windows Hello, which uses a PIN and biometrics (fingerprint or facial scan).
For accounts using a traditional password, make it long, complex and unique:
- at least 15 characters in length
- some capital letters, symbols and numbers
- a passphrase (4 or more unrelated words)
- one that is not used on any other account.
Use multi-factor authentication
Multi-factor authentication (MFA) adds an extra layer of security to your accounts by requiring two or more different methods to verify your identity. Microsoft offers several MFA options:
- Microsoft Authenticator app
- Windows Hello (biometrics or PIN)
- hardware security key.
Hardware security keys and biometrics are typically the most secure MFA methods, while SMS and email are less so.
Use a password manager
A password manager helps you store, manage and create complex passwords. ASD recommends the use of a standalone password manager.
Use a different password manager for your business accounts and keep your personal accounts separate.
Microsoft Windows offers two types:
- Windows Hello (where supported)
- Microsoft Edge
Apply software updates
Turn on automatic updates. This will ensure security fixes are installed early (for supported products) and keep your computer more protected. Go to:
1. Start, then Settings
2. Windows Update
3. Enable Automatic Updates
4. Under Advanced options, enable receive updates from other Microsoft products
You should also regularly check and enable automatic updates on third-party software.
Manage antivirus software
Microsoft offers Windows Defender, which helps protect your operating system from viruses and malware. It comes pre-installed and enabled by default.
You can also use third-party antivirus software, but be aware this can turn off Windows Defender.
If you uninstall third-party software, be sure to turn Windows Defender back on. Go to:
- Windows Security
- Virus & threat protection
- Toggle on Real-time protection
Back up your data
To back up your files, you can use the built-in Windows Backup feature. Go to:
- Start, then go to Settings
- Accounts
- Windows Backup (Windows 11) or Updates & Security, then Backup (Windows 10)
You can also back up to a cloud storage service like Microsoft OneDrive for ease of access from any location with an internet connection.
Another backup method is using an external hard drive and storing it in a secure location.