The ACSC's New Small Business Cyber Security Handbook: What to Read First
Australia's cyber security agency has put out something small businesses have needed for a while: a plain-English handbook that tells you what to do first, without assuming you have an IT department.
The Australian Cyber Security Centre published the Small business cyber security handbook on 7 October 2026, written for owners, managers and staff. You do not need to read it cover to cover. Start with its three starting measures, then read the chapters that match how your business works.
The three starting measures
The handbook says to begin with:
- Turn on multi-factor authentication (MFA)
- Keep your software up to date
- Regularly back up your data
That is the same advice we give local clients every week. MFA stops a stolen password from becoming a full takeover. Updates close the holes attackers already know about. Backups are what let you recover from ransomware without paying anyone.
If you only have one quiet afternoon this month, do those three across email, banking, accounting software and cloud storage. Everything else in the handbook builds on that base.
October is Cyber Security Action Month! Stephanie Crowe, Head of our Australian Cyber Security Centre emphasises the importance of this year's theme: Take a second. Stay secure. Learn more about the steps you can take to protect yourself 👉 cyber.gov.au/news/take-a-se…
Accounts, passwords and passkeys
The accounts chapter is the one most teams should read next. The handbook pushes strong, unique passwords or passkeys, and MFA on high-risk accounts: email, banking, cloud storage, accounting and social.
The specifics:
- Where MFA is on, passwords can be shorter (minimum six characters), but they should still be strong and unique.
- Where MFA is not available, use a password of at least 15 characters.
- Use a password manager with a strong unique master password, and put MFA on that vault too.
- Passkeys help stop fake-site logins, because a lookalike page cannot harvest them the way it can a password and a code.
If your team is already on Microsoft 365, our earlier piece on passkeys rolling out to business accounts walks through what Microsoft is changing and how to set them up without locking anyone out.
Business email compromise and ransomware
The common threats it covers include business email compromise, ransomware and denial-of-service. For a small Perth business, the first two are the ones that usually hurt.
Business email compromise is the invoice or payment-change scam that looks like it came from a real supplier or boss. The handbook's advice matches what we recommend locally: train staff on scams and phishing, and verify payment requests through a trusted channel (a phone number you already have, not the one in the email). More on how those scams land in Perth inboxes is in our phishing guide for small businesses.
Ransomware is why the backup measure is not optional. If you cannot restore from a recent backup that the attacker could not reach, you are negotiating from a bad spot.
Access, remote work, AI and incidents
These chapters are worth a skim even for a two-person shop.
Restrict and monitor access. Staff only get what they need for the job. Keep admin accounts separate from day-to-day logins. Review and remove access when roles change or someone leaves. Watch for unusual activity.
Remote working. Secure the home Wi-Fi: change the default network name and password, change the router login, use strong encryption, keep the router updated, and turn off remote management and UPnP if you do not need them. Use a guest network for visitors. Avoid public Wi-Fi for sensitive work; prefer home Wi-Fi or a personal hotspot.
Using AI securely. Do not paste passwords, financial details or confidential customer data into AI tools. Many tools store or use what you send. Treat them like any other online service. Prefer tools that let you delete history or limit storage, use separate accounts for testing, be cautious with free or public AI, and follow whatever internal policy you have.
Incident response. Know how you would detect, contain, respond and recover. Assign roles, know who to escalate to, and run a simple drill once so it is not theoretical. The ACSC also points to its recover-from-cyber-incident resources if something has already gone wrong.
Free help to save in your phone
You do not have to work through this alone. Two free services are worth saving in your phone:
| Service | What it does | Contact |
|---|---|---|
| Small Business Cyber Resilience Service (IDCARE) | One-on-one help to plan security, plus recovery support after an incident | 1800 595 170 |
| Australian Cyber Security Hotline | Help during a live cyber incident | 1300 CYBER1 (1300 292 371) |
The handbook itself sits on cyber.gov.au. Bookmark it. Hand the "starting three" page to whoever "does the tech" in the business.
If you would rather someone checked the basics against the handbook for you, that is the sort of quiet setup we do for Perth businesses and home users. A short appointment, a clear list of what is fine and what needs fixing, and no jargon.
