Start with three controls that stop most common attacks: multi-factor authentication on email, banking and key systems; automatic software and operating system updates; and regular backups that are kept separate and tested. The Australian Signals Directorate's free small business guidance at cyber.gov.au and its Essential Eight framework show what to add next.
What it depends on
The full answer depends on your specific circumstances. Here’s what matters.
Your systems
Cloud email, accounting and file storage each need MFA and access reviews. Former staff accounts are a common gap.
Your people
Most incidents start with a phishing email or a fake invoice. Simple staff training and a rule to verify bank detail changes by phone reduce risk dramatically.
Your recovery ability
If ransomware locked your files today, could you restore them? Backups only count if they have been tested.
The last 10%
What a qualified professional can add
The answer above covers the general position. Here’s where professional judgement — applied to YOUR specific situation — makes the difference.
- Assessing your current maturity against the Essential Eight
- Configuring MFA, backups and device management properly
- Running phishing simulations and incident drills
Questions to ask before you engage one
If you decide to engage a professional, these questions help you evaluate whether they’re right for your situation.
Is MFA enabled on every account that matters?
When were our backups last restored as a test?
Who still has access that should not?
What would we do in the first hour of an incident?
Did this answer your question?
General Advice Warning
The information on this page is general in nature and does not take into account your personal objectives, financial situation or needs. It is provided by Global Mutual Funds Pty Ltd (ABN 20 090 555 436, AFSL 222640) and should not be relied upon as a substitute for professional advice. Consider whether the information is appropriate before acting on it. Read our Financial Services Guide.