Small business cyber security handbook

Cyber security starts with your staff. Employees who have good practices are a critical defence against cyber threats. Clear response plans help reduce the impact of incidents and support business continuity. Staying informed through trusted sources and partnerships also helps your business prepare for evolving threats.

Educate staff

Your employees should have an awareness of cyber security, including the following topics:

• Common cyber threats such as business email compromise and ransomware.
• Protective measures including strong passwords, MFA and software updates.
• How to spot scams and phishing attacks.
• Business specific policies (for example, processes for reporting suspicious emails or for validating invoices before paying)
• What to do in an emergency.

Cyber security training should be refreshed periodically, for example with a formal course or internal training.

Make and test an emergency plan

A cyber security emergency plan helps reduce the impact of an incident and supports faster recovery. When an incident occurs, having a clear plan allows staff to act quickly instead of deciding what to do in the moment.

Your plan should outline:

• how staff report incidents
• who to contact for support (such as IT providers or your bank)
• how you will communicate with staff, customers and stakeholders
• how the business will continue operating if critical systems are unavailable.

Staff should understand their roles and responsibilities, and a copy of the plan should be available offline in case systems are inaccessible.

Getting started

Identify the cyber threats most relevant to your business, such as ransomware or business email compromise, and consider how they could affect operations. Develop a plan that includes key contacts and response steps, and review and test it regularly. Use tools like Exercise in a Box to test your response and improve your readiness.

Stay informed

Stay informed about emerging cyber threats by joining the ASD’s ACSC Partnership Program. As a partner, you will receive regular updates, including alerts and newsletters on new threats and vulnerabilities.

Cyber security is constantly evolving, and vulnerabilities can be exploited quickly after they are discovered. Staying up to date helps you understand current risks and take timely action to improve security.

The program also allows you to engage with the ACSC and a broader network of partners, sharing knowledge and strengthening cyber resilience across the Australian economy.