Australian businesses should start by identifying which laws and sector rules apply to them, then put practical security controls in place that match their systems and risks. Small-business status alone does not settle whether privacy obligations apply, and using the Essential Eight does not by itself make an organisation legally compliant.
Start with the obligations that actually apply
Before choosing a framework or buying security tools, map the business: its sector, the information it handles, its systems and cloud services, and the suppliers that can access or store its information. Record who owns each system and who is responsible for security and incident decisions. If the business is unsure whether a legal or sector-specific obligation applies, get advice based on its circumstances rather than relying on a general checklist.
As an Amazon Associate I earn from qualifying purchases.
Privacy Act and Notifiable Data Breaches
The Privacy Act 1988 and its Notifiable Data Breaches (NDB) scheme do not apply to every business on the same basis. The Office of the Australian Information Commissioner (OAIC) identifies organisations with annual turnover above AU$3 million, Australian Government agencies, private health service providers, credit reporting bodies, credit providers, entities trading in personal information, and tax file number (TFN) recipients among the entities with Privacy Act obligations. Some small-business operators are also covered. Whether a particular business is covered depends on its activities and circumstances, not just its size.
Recommended Free Tools
For an entity with relevant Privacy Act security obligations, the NDB scheme concerns eligible data breaches likely to cause serious harm, subject to exceptions. If an incident is suspected, contain it where possible, assess what information and people may be affected, keep records of the assessment and decisions, and notify affected individuals and the OAIC when required. Use current OAIC guidance to determine the applicable assessment and notification requirements; a security incident is not automatically an eligible data breach.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
APRA CPS 234
APRA Prudential Standard CPS 234 applies to APRA-regulated entities, not to small businesses generally. It requires covered entities to maintain information-security capabilities commensurate with threats and vulnerabilities. That includes identifying and classifying information assets, implementing controls, and maintaining incident-management processes. Information handled by related parties and third parties is relevant, so regulated entities need to account for suppliers that manage or hold information assets.
For an APRA-regulated entity, CPS 234 requires notification to APRA as soon as possible and no later than 72 hours after awareness of a specified material information-security incident. It also sets a 10-business-day deadline for notifying APRA of a material control weakness that the entity expects will not be remediated in a timely manner. These are requirements for entities within CPS 234’s scope; they are not general incident-reporting deadlines for Australian small businesses.
Essential Eight: a security framework, not a legal certificate
The Australian Cyber Security Centre (ACSC) designed the Essential Eight to mitigate cyber threats to internet-connected IT networks. Its eight strategies are:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
- Patch applications.
- Patch operating systems.
- Enable multi-factor authentication (MFA).
- Restrict administrative privileges.
- Implement application control.
- Restrict Microsoft Office macros.
- Harden user applications.
- Perform regular backups.
The Essential Eight uses maturity levels and should be assessed using the ACSC’s official assessment process. ACSC small-business guidance presents Maturity Level One as a starting point, while recognising that some businesses have more complex needs. A maturity level describes implementation of the framework; it does not determine whether a business meets every legal, contractual or sector-specific obligation.
How do I protect my small business from cyber threats?
Build controls in an order that reduces common exposure without losing sight of the business’s obligations. The ACSC’s practical starting points are MFA, software updates and backups. Its guidance also recommends that businesses with more complex needs consult an IT professional or trusted adviser.
- Map the environment. List the business’s information, devices, operating systems, applications, cloud services, remote-access routes and suppliers. Note where sensitive or personal information is held and who can reach it.
- Secure important accounts. Enable MFA first on email, banking, document storage and remote access. Use a distinct password or passphrase for every account. A password manager can help manage unique credentials; protect its vault with MFA and a strong master passphrase.
- Update and limit access. Keep operating systems and applications patched. Restrict administrative privileges to the people and tasks that need them, and work through the Essential Eight controls relevant to the business’s technology.
- Make recovery a planned capability. Select backup arrangements according to the business’s data, access needs and recovery requirements. Test restoring information, because a successful backup job alone does not prove that files can be recovered.
- Prepare for incidents. Assign escalation roles and maintain contact details, decision records and a way to preserve relevant evidence. Businesses potentially covered by the NDB scheme should establish a process for assessing suspected breaches; APRA-regulated entities should align their processes with CPS 234.
- Review changes. Revisit the inventory and controls when the business adds a service, changes suppliers, handles new types of information or changes how people work remotely.
How do I turn on multi-factor authentication?
For each important service, open its security or sign-in settings and enable the MFA method it supports. Exact menu names differ between services, so use that service’s current instructions. Set up a recovery method and make sure another authorised person can maintain access if the primary account holder is unavailable. Do not treat successful sign-in setup as complete until the recovery route has also been considered.
Rank #3
- XGS 118 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
The ACSC describes MFA as “one of the most effective ways to protect your valuable information and accounts against unauthorised access.” Its guidance identifies several ways to add an additional factor. The best fit depends on service support, recovery arrangements and how the business administers accounts.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| Method | Practical considerations |
|---|---|
| Physical security key | A hardware-based option. Check that the service, device and connection support the key and relevant protocol, and plan how authorised users will recover access if a key is lost. |
| Authenticator app | Supported by many services; confirm how codes or approvals will be restored or transferred if a device is replaced. |
| Passkey | Use where the service supports it, and understand how the passkey is available across the organisation’s devices and recovery process. |
| Biometrics | May be available through a supported device or service. Confirm the service’s setup and recovery options. |
| SMS or email code | Can be less secure than stronger methods such as hardware keys or biometrics, according to ACSC small-business guidance. Use it if it is the available supported choice, while considering whether the service offers another method. |
For an organisation, also decide how MFA is administered when staff join, change roles or leave. A method that works for one person may be difficult to manage across shared services or multiple devices.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I back up my business information?
Choose a backup approach by asking what must be restored, how quickly it is needed, who can access backup copies, and how long information must be retained. Compare options against data volume, recovery time, restoration testing, ransomware isolation, access control, retention and operating cost; no single medium is established as the right choice for every business.
Rank #4
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 3 years of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
An external drive is one possible removable backup medium. ACSC small-business guidance advises disconnecting it when it is not in use, which reduces the chance that malware can spread to it while it is connected. Cloud backup may better suit other requirements. Whichever approach is chosen, test restoration periodically and ensure someone knows how to carry it out.
What does a risk signal tell a business?
The Australian Signals Directorate’s 2026 reporting on 2024–2025 incidents said that compromised accounts or credentials were involved in 42% of incidents reported to ASD by industry, government and critical infrastructure sectors. That figure applies to those reported incidents and sectors; it is not a measure of all Australian business incidents. It nevertheless helps explain why account security, MFA and careful access management belong near the start of a practical security plan.
Free tools Windows power users keep installed
One-click scans. No signup required.
When should a business seek specialist help?
Consider an IT professional or trusted adviser when the business has complex systems, regulated operations, significant supplier dependencies, uncertainty about recovery, or limited internal capacity to implement and maintain controls. Define the work before engaging help: a gap assessment, control implementation, evidence collection and independent assessment are different scopes.
When evaluating a provider, ask about experience relevant to the business’s Australian sector and actual systems, the evidence and reporting the engagement will produce, the ongoing support model, and whether the provider is sufficiently independent if an independent assessment is needed. These are selection considerations, not a claim that a provider is accredited or that an engagement guarantees compliance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
