by The Computing Australia Group | 
Most cyber attacks on Australian businesses don’t start with clever hacking. They start with a stolen password, a convincing email or a payment request that nobody checked. That’s why cybersecurity best practices have to work at two levels: the everyday habits of every employee, and the controls and policies the business puts in place to back them up.
This guide covers nine habits every staff member should follow, nine things every company should have in place, and what to do if something goes wrong. It’s based on guidance from the Australian Signals Directorate (ASD) and what we see supporting businesses in Perth.
Updated 8 November 2026
What's changed in cybersecurity best practices
- ASD published guidance on AI-enabled attacks (July 2026). Attackers are using AI to move faster, which makes basic controls such as multi-factor authentication even more important. See habit 7.
- Ransomware payment reporting is enforced. Businesses above the $3 million turnover threshold must report ransomware payments to ASD within 72 hours. See "What to do".
- ASD Essentials published (October 2026). It succeeds the Essential Eight over about two years and shapes the company controls in this guide.
Nine cybersecurity best practices for every employee
These habits take minutes to learn and stop most everyday attacks. Select one to jump to the detail.
Use passphrases
Long, unique and stored in a password manager.
Turn on MFA
A second check that stops most account takeovers.
Pause before you click
Check the sender and the link, every time.
Verify payment changes
Call a known number before changing bank details.
Install updates promptly
Updates close the gaps attackers use.
Lock your devices
Screen locks, encryption and no unattended laptops.
Use AI tools safely
Keep confidential data out of unapproved tools.
Stick to approved apps
No personal file sharing or unknown USB drives.
Report anything odd
Fast reporting limits the damage. No blame.
1. Use passphrases and a password manager
ASD recommends passphrases made of four or more random words and at least 15 characters, such as “crystal onion clay pretzel”. Use a different one for every work account, and let a company-approved password manager remember them. Reused passwords are dangerous because one breach can unlock several accounts.
2. Turn on multi-factor authentication
Multi-factor authentication (MFA) asks for a second proof of identity, such as an app prompt, after your password. As a result, a stolen password alone isn’t enough. Approve sign-in prompts only when you’ve just tried to log in yourself, and report any unexpected ones.
3. Pause before you click
Phishing emails and texts often pretend to come from a supplier, a bank, a delivery service or your own manager. Before you click a link or open an attachment, check the sender’s actual address, hover over links to see where they go, and be wary of urgency or unusual requests.
4. Verify any change to payment details
Business email compromise scams trick staff into paying invoices into a criminal’s account, often by imitating a real supplier’s email. Therefore, if anyone asks you to change bank details or make an urgent payment, call them on a number you already have, not one in the email.
5. Install updates promptly
Software updates fix security weaknesses that attackers actively look for. Restart when prompted, and don’t postpone updates for days. If your device is managed by IT, let updates install rather than cancelling them.
6. Lock your devices and keep them with you
Lock your screen whenever you step away, and never leave a laptop or phone unattended in a car or public place. A lost device with no screen lock can give someone access to email, files and saved passwords.
7. Use AI tools safely
AI tools are useful, but anything you paste into an unapproved tool may leave your business’s control. So only use the AI tools your organisation has approved, and keep client, financial and personal information out of public chatbots. Also be aware that attackers use AI to write more convincing scams, so a well-written email is no longer a sign it’s genuine.
8. Stick to approved apps and storage
Personal file-sharing services, browser extensions and unknown apps can expose company data. Likewise, never plug in a USB drive you found or were sent unexpectedly. Our article on the dangers of unknown USB devices explains why.
9. Report anything suspicious straight away
If you clicked a link, entered a password or noticed something odd, tell IT immediately. Quick reporting can turn a serious incident into a minor one. In addition, good businesses make reporting easy and blame-free, because people who fear getting in trouble tend to stay quiet.
Cybersecurity best practices for the company
Employee habits work best when the business backs them up with the right controls. Most of these align with ASD’s Essential Eight.
Enforce MFA
Require multi-factor authentication for email, remote access and all admin accounts.
Separate admin accounts
Give staff everyday accounts, and keep admin rights to a few separate accounts.
Patch and manage devices
Use device management to keep operating systems and apps up to date.
Back up and test restores
Keep backups separate from your main systems and test that they work.
Train staff regularly
Short, regular training beats a once-a-year session.
Plan your incident response
Know who does what, who to call and what you must report.
Offboard properly
Remove access on the day someone leaves.
Set an AI use policy
Name the approved tools and what data they can use.
Monitor and review
Watch for threats around the clock and review supplier access.
For detail, read our guides to the Essential Eight, cyber security training for staff, stopping ex-employees from compromising your business and keeping business data secure.
When cybersecurity best practices aren’t enough: what to do
Even with good habits, incidents happen. What matters is acting quickly and calmly.
- Tell IT immediately. Don’t try to fix it quietly. The earlier IT knows, the more they can contain.
- Disconnect if asked. Your IT provider may ask you to take a device off the network to stop an attack spreading.
- Change passwords from a clean device. Start with email and any account you may have entered details into.
- Keep the evidence. Don’t delete suspicious emails or messages until IT has seen them.
- Report it. Report cybercrime through ReportCyber at cyber.gov.au or call ASD’s 24/7 hotline on 1300 CYBER1 (1300 292 371).
Businesses above the $3 million turnover threshold must also report any ransomware payment to ASD within 72 hours, and data breaches likely to cause serious harm must be reported under the Notifiable Data Breaches scheme. Our ransomware guide covers this in more detail.
Why AI makes cybersecurity best practices more important
AI helps attackers write convincing scams quickly and in any language. As a result, the old advice to look for spelling mistakes no longer works on its own.
- Rely on process, not instinct. Call-back checks for payments catch scams however well they’re written.
- Make MFA universal. It blocks most account takeovers even when a password is stolen.
- Use AI on your side. Modern email filtering and endpoint protection use AI to spot attacks people miss.
Read more about our AI consulting and automation services.
How CAG helps put cybersecurity best practices in place
Our Perth team helps businesses turn these practices into everyday reality. We provide staff cyber awareness training, Essential Eight assessments and help mapping your controls to ASD Essentials, plus cyber security audits. Through our managed IT services, we add 24/7 monitoring, endpoint detection and response with automatic containment, and tested backups.
If an incident does happen, we help you contain the attack, preserve evidence and restore from backups. For the bigger picture, read our guide to cybersecurity or see our cyber security services.
Perth cyber security
Want your team to be your best defence?
Talk to us about staff training, an Essential Eight assessment or a review of your current security. We'll explain where you stand in plain English.
Your questions answered
Cybersecurity best practices for staff
What is the most important cybersecurity habit for employees?
Turning on multi-factor authentication and using a unique passphrase for each account. Together, they stop most account takeovers.
How do I spot a phishing email?
Check the sender’s real address, hover over links before clicking, and be wary of urgency, unusual requests or changes to payment details. When in doubt, check with the sender using contact details you already have.
What should I do if I clicked a suspicious link?
Tell IT straight away, then change your password from a different, clean device. Quick reporting makes a big difference.
Cybersecurity best practices for companies
How often should staff have cyber security training?
Short, regular sessions work better than a single annual course. Many businesses combine quarterly refreshers with simulated phishing tests.
Does a small business need the Essential Eight?
It’s not mandatory for most private businesses, but it’s the benchmark many insurers and clients ask about, and it covers the controls that stop most common attacks.
Who should we report a cyber incident to?
Report cybercrime through ReportCyber at cyber.gov.au or call 1300 CYBER1. Depending on the incident, you may also need to notify the OAIC and, for ransomware payments, ASD within 72 hours.
Sources and further reading
- Australian Signals Directorate — Creating strong passphrases
- Australian Signals Directorate — Essential Eight
- Australian Signals Directorate — ASD Essentials
- ASD — Defending against AI-enabled cyber attacks: Guidance for small businesses (PDF)
- Australian Signals Directorate — Small business cyber security
- Department of Home Affairs — Ransomware payment reporting factsheet (PDF)
- OAIC — Notifiable Data Breaches scheme
This article is general information, not legal advice. Last reviewed 8 November 2026.
About the author
Gordon Murdoch
Director (Policy, Compliance and Training), The Computing Australia Group
Gordon leads CAG’s policy, compliance and training work. He helps organisations turn security requirements into practical policies their teams can actually follow, and drives projects that use AI and other tools to lift efficiency and service quality. His view is simple: compliance should make a business stronger, not just tick a box.
