Cyber security basics for small business

Cyber security is part of running a connected business

Businesses rely on email, online banking, cloud services, websites, mobile devices and digital customer records every day. Protecting these systems, accounts and information is an important part of running a business.

Cyber security for small business helps protect data, devices, accounts and online services from unauthorised access, disruption, loss or misuse.

You don't need to become a cyber security expert, but understanding your risks and putting a few practical safeguards in place can help reduce the impact of a cyber incident.

Start with what your business needs to protect 

Before choosing security tools, make a simple inventory of the information and technology your business uses. 

Consider:

• customer, employee and financial information
• email, banking, social media and cloud accounts
• computers, phones, tablets, servers and connected equipment
• your website, online store and payment systems
• software and cloud services
• suppliers or contractors that can access your data or systems
• the information and services your business needs to keep operating.

For each item, ask:

• Where is it stored?
• Who can access it?
• Who is responsible for it?
• What would happen if it became unavailable, was changed or was shared without permission?
• Is there a current backup or another way to continue operating?

Once you understand what matters most to your business, you can focus your efforts on the cyber security measures that will have the greatest impact. 

Seven cyber security basics 

You don't need to tackle everything at once. These seven cyber security basics can help reduce risk, strengthen your defences and provide a practical starting point for protecting your business, people and information.

1. Protect accounts with unique passwords or passkeys

Reusing a password across several accounts creates unnecessary exposure. If one service is compromised, the same sign-in details may be tried elsewhere.

For each important account:

• use a unique password or passphrase
• use a password manager where practical
• use a passkey where available.

For more detailed guidance, see password management tips for business.

2. Turn on multi-factor authentication 

Multi-factor authentication, or MFA, asks for another form of verification in addition to a password.

Depending on the service, this may involve an authenticator, passkey, security key, device prompt or biometric check. Start with accounts that provide access to important business information, such as email, banking, cloud services and administrator accounts.

Never approve an unexpected MFA prompt or share a verification code in response to an unsolicited request.

Learn more about two-factor and multi-factor authentication.

3. Keep devices and software up to date 

Software updates can include fixes for known security weaknesses. Delaying important updates may leave devices, applications or services exposed.

Enable automatic updates for devices, operating systems, applications and security software wherever possible.

Where an update cannot be installed automatically, assign responsibility for checking and applying it. Retire products that can no longer receive supported security updates where appropriate.

Learn why automatic updates help keep your business secure. 

4. Back up important information and test recovery

A backup is only useful if the information can be restored when needed.

Make sure important business information is backed up regularly and that you know how to restore it if needed.

A common approach is the 3-2-1 backup strategy: keep three copies of important data, on two types of storage, with one copy kept away from the primary location.

Explore how the 3-2-1 backup strategy works.

5. Limit access to what each person needs 

Not every employee, supplier or contractor needs access to every system.

Review access when someone:

• joins the business
• changes role
• begins or finishes a project
• no longer works with the business.

Keep administrator access separate from everyday work where practical. Also check whether third parties can still access old shared folders, accounts or applications.

A simple access review can identify unnecessary permissions before they become a problem.

6. Help your team build cyber security awareness

Employees play an important role in helping protect your business. Helping staff recognise suspicious messages, verify unusual requests and follow safe online practices can reduce cyber risk. Regular training and awareness activities can help reinforce these behaviours over time.

Learn how cyber security training can help protect your business.

7. Prepare for a cyber incident 

Even with sensible safeguards, it's helpful to have a simple response plan.

Make sure staff know:

• who to contact
• where important backups are stored
• how to isolate affected devices or accounts
• how the business will continue operating if key systems are unavailable.

Review this plan whenever your team or technology changes.

Your suppliers play a role too

Your cyber security isn't only affected by your own systems. Cloud services, software providers, contractors and other suppliers may also have access to business information. Make sure you understand what they can access, how they protect your information and who to contact if something goes wrong. 

If your business uses cloud services, learn why cloud security matters for business.

A simple cyber security check-in

You don't need to solve everything at once. Start by asking yourself a few simple questions: 

• Do we know which business data, accounts and devices are most important?
• Are we using strong passwords or passkeys and MFA?
• Are backups running and tested?
• Do staff know how to spot suspicious requests?
• Do we have a plan for what to do if something goes wrong?

If you answered "no" or "not sure" to any of these questions, choose one area to improve first. Small changes made consistently can make a meaningful difference to your cyber security. 

Once you've covered the basics, explore the ASD Essential Eight framework to identify additional cyber security practices that may be appropriate for your business. 

As your business grows, consider developing a cyber security strategy that aligns cyber security activities with your business risks, priorities and growth plans.

Need extra support?

You don't need to figure everything out on your own. Cyber security can feel overwhelming, especially when you're balancing the many demands of running a business. The options below can help if you're looking for expert guidance, device protection or ongoing support. 

Speak to a Business Technology expert

Get guidance on cyber security, connectivity and technology solutions that may be suitable for your business.

Request a callback from your Telstra Business Technology Centre.

Device Security for Business

Looking for straightforward protection for business devices? Explore security solutions designed to help keep your devices and business data safer.

Learn about Device Security for Business

Managed Services

If your business has more complex technology or security requirements, managed services can provide ongoing support and expertise.

Explore Managed Services