Updated 26 October 2026. This refresh replaces the article’s old statistics and penalty figures with practical steps and links to current Australian guidance.
Australian businesses rely on email, cloud applications, connected devices and suppliers to operate. Cyber security needs to cover those everyday dependencies as well as the systems inside the office. Start with a clear view of what you use, who can access it and how the business would recover from a disruption.
Know the systems and accounts you depend on
Maintain an inventory of important applications, devices, administrator accounts and suppliers. Assign an owner to each business-critical service. Remove access that is no longer needed and check that staff know how to report an unexpected sign-in or suspicious message.
Strengthen everyday controls
Keep supported software up to date, use strong unique passwords and enable multifactor authentication where available. Give staff the access they need for their role and separate routine use from administration. The Australian Cyber Security Centre’s small business cyber security guide is a useful starting point for prioritising these controls.
Prepare for recovery
Decide which services must return first after an outage and how much data the business could afford to lose. Maintain backups that are protected from ordinary account compromise and test restoration. Record the dependencies, recovery steps and people needed to carry out the plan.
Practise your incident response
Keep contact details and escalation steps available when normal systems are unavailable. Run a short exercise that tests decisions about containment, communications and recovery. Where personal information may be affected, use current OAIC guidance and appropriate advice to assess the response; historical fine figures are not a reliable planning tool.
Review responsibilities regularly
Check your controls when staff, suppliers or applications change. Agree who monitors risks, approves changes and follows up unresolved issues. Useful measures include supported-device coverage, multifactor-authentication coverage and completed recovery tests.
Explore cyber security services, managed IT support and backup and business continuity. Talk to MaxIT about practical priorities for your organisation.