by The Computing Australia Group | 
This cybersecurity guide covers what an Australian business needs to know to protect itself in 2026: the threats you’re most likely to face, the rules you must follow, the frameworks worth using and the practical controls that stop most attacks. It’s long, so use the guide map to jump to the part you need. Each part also links to our more detailed articles.
Cyber security isn’t only an IT problem. It touches finance (invoice fraud), HR (new starters and leavers), legal (privacy and breach reporting) and leadership (risk and budget). The good news is that a small number of well-run controls prevent most incidents, and none of them needs an enterprise budget.
Updated 7 November 2026
What’s new in this cybersecurity guide for 2026
- ASD Essentials published (15 Oct 2026). It succeeds the Essential Eight over about two years. Part 3 explains what to do now.
- Ransomware payment reporting (from 30 May 2025). Businesses with turnover above $3 million must report a ransomware or extortion payment to ASD within 72 hours. See Part 2.
- Privacy Act security duty sharpened (Dec 2024). APP 11 now says reasonable steps include technical and organisational measures. See Part 2.
- Windows 10 support ended (14 Oct 2025). PCs still running it need an upgrade or paid Extended Security Updates. See Part 5.
Why every business needs a cybersecurity guide: the numbers
The Australian Signals Directorate’s (ASD) latest annual report shows how common, and how costly, cyber crime has become.
ASD also responded to more than 1,200 cyber security incidents in 2024–25. For a medium business, the average self-reported cost of a cybercrime report reached $97,200.
How to use this cybersecurity guide
The guide is in nine parts. Select a part to jump straight to it, or read from top to bottom for the full picture.
The threats you face
What attacks Australian businesses actually see.
The rules
Privacy, breach reporting and ransomware payments.
The frameworks
ASD Essentials, Essential Eight, NIST and ISO.
Protect identities
MFA, passwords and admin accounts.
Protect devices and systems
Patching, EDR, encryption and networks.
Protect email and people
Phishing, invoice fraud and training.
Protect your data
Backups, cloud, file sharing and AI tools.
Detect and respond
Monitoring, incident plans and reporting.
Build your programme
Where to start, by business size.
Part 1: The threats you face
The first lesson in any cybersecurity guide is that most attacks on Australian businesses aren’t sophisticated or personal. Criminals use automated tools and convincing messages to find whoever is easiest to get into. These are the threats that cause most of the damage.
Phishing and invoice fraud
Fake emails and texts that steal logins or trick staff into paying fake invoices, often called business email compromise.
Ransomware and extortion
Criminals steal data, encrypt systems and demand payment, sometimes threatening to publish what they took.
Account takeover
Stolen or reused passwords, and repeated MFA prompts that wear users down, give attackers a working login.
Unpatched systems
Known vulnerabilities in firewalls, VPNs, websites and software that were never updated.
Suppliers and cloud services
Your IT provider, software vendors and SaaS apps can become a way in if they’re compromised.
Insiders and mistakes
Departing staff with access, misdirected emails and files shared publicly by accident.
On top of that, generative AI has made some of these attacks more convincing. Phishing emails now arrive in flawless English, and voice cloning can make a “quick call from the boss” sound real. As a result, simple verification habits matter more than ever, such as calling back on a known number before changing bank details.
Go deeper: Ransomware as a service · Ex-employee risks
Part 2: The rules you must follow
Next, this cybersecurity guide turns to the law. Several Australian laws now set clear expectations for how businesses protect information and respond to incidents. Here are the three most businesses need to know.
Privacy Act: APP 11
Businesses covered by the Privacy Act must take reasonable steps to protect personal information. Since December 2024, those steps expressly include technical and organisational measures, such as policies and training.
Notifiable Data Breaches
If you suspect an eligible data breach, you must assess it quickly, and within 30 days at most. Breaches likely to cause serious harm must be reported to the OAIC and the people affected.
Ransomware payment reporting
Under the Cyber Security Act 2024, businesses with annual turnover above $3 million must report a ransomware or extortion payment to ASD within 72 hours.
The same Act also introduced minimum security standards for consumer smart devices sold in Australia, which is worth remembering when you buy cameras, printers or other connected gear. Furthermore, some sectors, such as critical infrastructure, health and financial services, carry extra obligations on top of these.
In addition, APP 11 requires you to destroy or de-identify personal information you no longer need. In other words, data you don’t keep can’t be stolen. This is general information, not legal advice, so check with a lawyer how these rules apply to your business.
Part 3: The frameworks worth using
A framework turns a cybersecurity guide like this one into a checklist, and gives you a way to measure progress. You don’t need all of them; most Australian businesses start with ASD’s guidance.
| Framework | Best for | What it gives you |
|---|---|---|
| ASD Essentials | Australian businesses planning ahead | ASD’s new baseline, published October 2026, which succeeds the Essential Eight over about two years. |
| Essential Eight | Most Australian organisations today | Eight mitigation strategies with maturity levels, from patching and MFA to backups and application control. |
| NIST CSF 2.0 | Governance and broader risk management | Six functions (Govern, Identify, Protect, Detect, Respond and Recover) for organising a full programme. |
| ISO/IEC 27001 | Businesses that need certification | A formal, auditable information security management system. |
In practice, if you already work to the Essential Eight, keep going: the controls carry across, and you can map them to ASD Essentials over time. For most small businesses, reaching Maturity Level One across all eight strategies is a sensible first target.
Go deeper: The Essential Eight explained · A practical NIST CSF 2.0 roadmap · NIST vs ISO 27001
Part 4: Protect your identities
Most breaches start with a stolen or guessed login, which is why identities come first among the controls in this cybersecurity guide. Protecting accounts is therefore the single most effective thing you can do.
- Turn on MFA everywhere it counts. Start with email, remote access, finance systems and admin accounts. Use authenticator apps with number matching, and passkeys or security keys for admins.
- Use a password manager. Unique, generated passwords for every system end password reuse.
- Separate admin accounts. Admins should do email and browsing from a standard account.
- Block legacy sign-in. Older protocols skip MFA, so switch them off.
- Offboard on the day. Disable accounts and revoke access the day someone leaves.
Go deeper: Stop ex-employees compromising your business
Part 5: Protect your devices and systems
Meanwhile, attackers scan constantly for unpatched systems. ASD’s Essential Eight expects patches for internet-facing services within 48 hours when a vulnerability is critical or being exploited, and within two weeks otherwise. Automatic updates handle most of this, as long as someone checks they actually installed.
However, unsupported software is the bigger risk. Windows 10 reached end of support on 14 October 2025, so any business PC still running it needs an upgrade or paid Extended Security Updates. Also check firewalls, routers, NAS drives and website plug-ins.
- Use endpoint detection and response (EDR). It spots suspicious behaviour and can isolate an infected device automatically.
- Monitor around the clock. Alerts are only useful if someone acts on them, including at 2 am.
- Encrypt and manage devices. BitLocker or FileVault, plus remote wipe for lost laptops and phones.
- Control what runs. Limit macros and unapproved software, and remove local admin rights.
- Segment your network. Keep guest Wi-Fi, cameras and other smart devices away from business systems.
- Test your defences. A penetration test shows how an attacker would actually get in.
Go deeper: Employee mobile security · Unknown USB device risks · Penetration testing for business
Part 6: Protect email and your people
Similarly, email remains the front door for most attacks, and people are both the target and the best defence. Technical filters catch a lot, but clear processes catch what slips through.
- Filter inbound email. Block malicious links and attachments before they reach inboxes.
- Set up SPF, DKIM and DMARC. They make it harder for criminals to send email that looks like it came from your domain.
- Verify payment changes by phone. Call a number you already hold, never one in the email.
- Require two approvals for large payments. A simple rule that defeats most invoice fraud.
- Train little and often. Short sessions and phishing simulations build habits better than an annual slideshow.
- Make reporting easy. A one-click “report phishing” button and a no-blame culture get warnings to IT fast.
Go deeper: Cyber security training for staff
Part 7: Protect your data
For this part of the cybersecurity guide, start by knowing what data you hold, where it lives and who can reach it. You can’t protect, or report on, information you don’t know you have.
- Limit access. Give people the data their role needs, and review permissions twice a year.
- Back up using 3-2-1. Three copies, two types of storage, one offline or immutable so ransomware can’t delete it.
- Test your restores. A backup only counts once you’ve proved it restores.
- Back up Microsoft 365 too. Built-in retention isn’t a full backup.
- Share files safely. Use expiring links and approved platforms, not personal email or USB sticks.
- Set rules for AI tools. The OAIC advises against entering personal information into publicly available AI tools.
Go deeper: Tips to keep your business data secure · Data backup and disaster recovery · Microsoft 365 for business
Part 8: Detect and respond
However, no defence is perfect, so any useful cybersecurity guide must plan for the day something gets through. Fast detection and a calm, rehearsed response limit the damage. Above all, keep your plan short, printed and known to the people who need it.
Contain
Disconnect affected devices and reset compromised accounts.
Preserve evidence
Keep logs and devices intact; don’t wipe them straight away.
Assess
Work out what data was involved. A suspected eligible breach must be assessed within 30 days.
Report
Use ReportCyber or call 1300 CYBER1 (1300 292 371), 24/7. Notify the OAIC if serious harm is likely.
Recover
Restore from clean, tested backups once the threat is removed.
Review
Fix the root cause and update your plan and training.
If you’re a CAG client, we help contain the attack, preserve evidence and restore from backups. When an incident needs closer investigation, our computer forensics team provides evidence preservation, forensic analysis and reports.
Go deeper: Signs your company has been hacked
Part 9: Turn this cybersecurity guide into a plan
Start with a short cybersecurity risk assessment to see which risks matter most for your business. Then work through the controls that close the biggest gaps first. If you only do five things this quarter, make it these:
- MFA on email, remote access and finance. The biggest single risk reduction for the effort.
- Automatic updates, checked. And a plan to replace anything unsupported.
- Offline backups, tested. So ransomware can’t take everything.
- Payment verification rules. Call back before any bank detail change.
- A one-page incident plan. Who to call, what to do, where the backups are.
| Business size | Focus first | Then add |
|---|---|---|
| Micro (1–5 staff) | MFA, password manager, updates, backups | Basic email filtering and a simple incident plan |
| Small (5–50 staff) | Everything above, plus EDR, email security and staff training | Essential Eight Maturity Level One and regular phishing simulations |
| Medium (50–200 staff) | 24/7 monitoring, formal risk register, tested incident response | Higher Essential Eight maturity, ASD Essentials mapping and penetration testing |
Finally, decide who does the work. Some businesses build an in-house team, many use a managed provider, and plenty combine both. Whatever you choose, give cyber security an owner, a budget and a regular slot on the leadership agenda.
Go deeper: How managed IT strengthens your cybersecurity strategy · In-house vs managed IT · Why proactive IT support matters
AI: a new risk and a new defence
AI helps attackers write better scams, but it also helps defenders spot threats faster. For businesses adopting AI, the bigger day-to-day risk is data leaking through tools staff use without rules. Microsoft 365 Copilot, for example, can surface any file a user already has permission to open, so loose permissions become easier to exploit.
- Copilot readiness. We review permissions before Copilot goes live, so it only finds what each person should see.
- AI use policy. We help you set clear rules on approved tools and what data staff can share.
- Secure AI projects. Our AI assistants and workflow automations plan security, privacy and human review from day one.
Learn more about our AI consulting and automation services.
How CAG puts this cybersecurity guide into practice
Our Perth team helps businesses across Western Australia and beyond turn the advice above into day-to-day protection:
- Cyber security services, including 24/7 monitoring, EDR with automatic containment, phishing simulations and security awareness training.
- Cyber security audits and Essential Eight assessments, plus help mapping your existing controls to ASD Essentials.
- NIST compliance support for businesses that need a broader framework.
- Disaster recovery and cloud backup that are tested, not assumed.
- Managed IT services that keep patching, devices and accounts in good shape.
- Computer forensics when an incident needs evidence preserved and analysed.
Perth cyber security
Not sure where to start?
Talk to our team about a security review. We’ll check your business against this guide and give you a plain-English, prioritised plan.
Your questions answered
Cybersecurity guide basics
What is cybersecurity in simple terms?
It’s the mix of technology, processes and habits that keeps your systems, data and money safe from criminals and accidents, and helps you recover quickly when something goes wrong.
Are small businesses really targeted?
Yes, often because they’re easier to get into. Most attacks are automated and opportunistic, so attackers don’t need to know who you are to cause damage.
Where should we start?
Turn on MFA, check updates are installing, test a backup restore and set a rule for verifying payment changes. Then run a short risk assessment to plan the rest.
Is antivirus enough?
No. Modern attacks often use legitimate tools and stolen logins, so you need MFA, patching, backups, email security and monitoring alongside endpoint protection.
Rules, costs and getting help
Do we have to report a data breach?
If the Privacy Act covers you and a breach is likely to cause serious harm, you must notify the OAIC and the people affected. You must assess a suspected breach within 30 days at most.
How much should we spend on cyber security?
It depends on your size, data and risk. Many of the most effective steps, such as MFA and automatic updates, use tools you already pay for. A risk assessment helps you spend where it counts.
Does cyber insurance replace security controls?
No. Insurance can cover some costs, but it won’t prevent an incident or restore your systems, and insurers commonly ask about controls such as MFA and backups.
Who do we call during an incident?
Your IT provider first, then report to ASD through ReportCyber or the 24/7 hotline on 1300 CYBER1 (1300 292 371). If personal data is involved, you may also need to notify the OAIC.
Sources and further reading
- Australian Signals Directorate — Annual Cyber Threat Report 2024–2025
- Australian Signals Directorate — ASD Essentials
- Australian Signals Directorate — Essential Eight maturity model and ISM mapping
- Australian Signals Directorate — Ransomware and cyber extortion payment reporting
- Federal Register of Legislation — Cyber Security Act 2024
- OAIC — Quick reference guide: responding to data breaches
- Clyde & Co — Cyber and privacy law update (APP 11 technical and organisational measures)
- Microsoft — Windows 10 Extended Security Updates
- NIST — Cybersecurity Framework 2.0
- OAIC — Guidance on privacy and the use of commercially available AI products
This article is general information, not legal advice. Talk to a lawyer about how privacy and cyber laws apply to your business. Last reviewed 7 November 2026.
About the author
Gordon Murdoch
Director (Policy, Compliance and Training), The Computing Australia Group
Gordon leads CAG’s policy, compliance and training work. He helps organisations turn security requirements into practical policies their teams can actually follow, and drives projects that use AI and other tools to lift efficiency and service quality. His view is simple: compliance should make a business stronger, not just tick a box.
