The short answer
A small business cyber security checklist for an Australian SMB in 2026 comes down to ten controls: multi-factor authentication, operating system patching, application patching, email filtering and authentication, endpoint detection and response, tested backups, a business-grade firewall, restricted admin privileges, staff awareness training, and a written incident response plan.
Five of those map directly to the Australian Signals Directorate’s Essential Eight. If you can only start with three this quarter, start with MFA, a tested restore, and the incident response plan, in that order.
10Controls on the checklist, in priority order
5That map to the ASD Essential Eight
650+Businesses supported across Melbourne and Australia
SophosCertified endpoint protection partner
Most cyber security advice for small business is either terrifying or useless. A wall of ransomware statistics, then nothing on what to actually do Monday morning. This is the other thing: ten controls, each framed as the question an owner actually asks, with a direct answer first and the reasoning after.
Good cyber security for small business in Melbourne rarely requires a security team. Most of it is configuration on licences you already pay for. Work down the list. Wherever you cannot tick an item with confidence, that is your starting point.
The small business cyber security checklist at a glance
Take the one-page version with you
The full checklist as a printable A4 page: ten controls, what good looks like for each, and the three to start with this quarter. No form, no email address required.
Where this comes from
Five of these ten controls are the Essential Eight, written in plain English.
Australian Signals Directorate · ACSC
What is the Essential Eight, and does it apply to small business?
Yes. The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate. It is mandatory for federal government entities, and voluntary but widely used as the benchmark for Australian businesses of any size, including small ones.
The eight strategies are: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Each is measured against a maturity model running from Maturity Level Zero to Three.
You do not need Maturity Level Three. Most Melbourne SMBs sit somewhere between Zero and One, and moving from Zero to One is where nearly all of the risk reduction happens. The Essential Eight framework is the authoritative reference. The ACSC also publishes cyber security basics aimed squarely at non-technical owners.
Naming it is useful in practice: ask an IT provider “which of the Essential Eight do we meet, and at what maturity level?” and you either get a specific answer, or you learn something important about your provider. We cover that question and others in our guide to choosing a managed IT support provider.
01
Must have
Do I need multi-factor authentication?
Yes, this is the single highest-impact control on the list, and it is free. Multi-factor authentication blocks the overwhelming majority of account-takeover attacks, and it is already included in the Microsoft 365 licences you pay for.
MFA means a password plus something else: a code from an authenticator app, a prompt on your phone, or a hardware key. If an attacker buys your password from a breach dump, and there is a reasonable chance one of your staff passwords is already in one, MFA is what stops that password from being enough on its own.
Three details matter more than the decision itself:
- Enforce it by policy, not opt-in. Opt-in MFA reaches maybe half your users.
- Use an app or hardware key, not SMS. SMS codes can be intercepted through SIM-swap attacks.
- Cover everything, not just email: remote access, your accounting platform, banking, and any admin portal.
Essential Eight
Multi-factor authentication is Essential Eight strategy seven. The ACSC’s MFA guidance explains the mechanism in non-technical language if you need to make the case internally.
What good looks like
MFA enforced by conditional access policy across Microsoft 365, remote access and finance systems, using an app or hardware key.
Red flag
MFA available but optional, SMS-only codes, or admin accounts exempted “because it is inconvenient”.
02
Must have
How quickly do I need to install operating system updates?
Within two weeks of release, and within 48 hours for critical vulnerabilities being actively exploited. That is the Essential Eight benchmark for operating system patching. It applies to Windows, macOS, servers and network devices.
The gap between a vulnerability going public and being exploited at scale is now measured in days. Patching is unglamorous, and it is the reason most breaches did not have to happen.
For a business with more than a handful of machines, patching needs to be automated and reported on, not left to whoever notices the restart prompt. Managed patching applies updates on a schedule, reports what succeeded, and flags the machine that has been deferring a restart for three weeks. There is always one.
Essential Eight
Patching operating systems is Essential Eight strategy six. Maturity Level One expects patches for internet-facing services within two weeks, and within 48 hours where an exploit exists.
What good looks like
Automated patching on a defined schedule, with a monthly report showing compliance per device.
Red flag
“Windows updates itself.” No visibility into which machines are actually current.
03
Must have
What about browsers, Office and other applications?
Same standard, and arguably more urgent. Browsers, Office, PDF readers and anything else that opens files from the internet are the most common entry points into a small business network.
Operating system patching gets attention because it is visible. Application patching gets skipped because it is scattered across a dozen vendors with a dozen update mechanisms. That gap is exactly why attackers favour the application layer.
The practical answer is third-party patch management covering the whole application inventory, not just Microsoft products. It is also worth removing software nobody uses. Every application you uninstall is one you never have to patch again.
Essential Eight
Patching applications is Essential Eight strategy two. Microsoft Office macro settings (strategy three) and user application hardening (strategy four) sit in the same territory: reduce what the browser and Office are allowed to execute.
What good looks like
A managed inventory of installed applications, with automated third-party patching and a defined removal process.
Red flag
Patching that covers Windows only, with Chrome, Adobe Reader and Java left to fend for themselves.
04
Must have
Do I need email filtering if I am already on Microsoft 365?
Yes. Microsoft 365’s built-in filtering is a reasonable baseline, but it does not configure your domain authentication records. Those are what stop someone sending email that appears to come from you.
There are two separate problems here, and they get conflated constantly.
- Inbound is filtering. Stopping phishing and malware before it reaches a person. Microsoft 365 does a decent job by default, and a considerably better one when Defender policies are actually tuned rather than left at their defaults.
- Outbound is authentication. SPF, DKIM and DMARC records tell the rest of the world which servers may legitimately send mail as your domain.
Most small businesses have SPF partially configured, DKIM not configured, and DMARC absent entirely. That combination means an attacker can send invoices to your customers that appear to come from your domain, and nothing will stop them.
Fixing it is DNS configuration, not a product purchase. It takes an afternoon, and it is the highest-value hour of email work most businesses never do.
Essential Eight
Not an Essential Eight strategy directly, though it supports user application hardening. The ACSC’s phishing guidance explains what staff are actually being asked to spot.
Our Microsoft 365 security services page covers tenant hardening in more detail. If you are considering Copilot, the same governance work is a prerequisite: see how to prepare your business for Microsoft Copilot, because Copilot surfaces whatever your permissions already allow.
What good looks like
Defender policies tuned beyond defaults, plus SPF, DKIM and DMARC configured, monitored and moving toward an enforcing DMARC policy.
Red flag
Default filtering, no DMARC record, and no one monitoring what is being sent using your domain name.
05
Must have
Is traditional antivirus still enough?
No. Signature-based antivirus only recognises malware it has seen before. Endpoint detection and response watches for malicious behaviour, which is what catches attacks that have never been catalogued.
The distinction is concrete. Antivirus asks: is this file on a list of known-bad files? EDR asks: why is a Word document spawning PowerShell and encrypting files in the finance folder? Ransomware in 2026 is routinely novel enough that the first question returns nothing useful.
This is where vendor certification earns its keep, so here is the specific claim rather than vague reassurance. SouthEast IT is a Sophos-certified partner. Our engineers hold current Sophos accreditation, we manage deployments through the central Sophos console rather than leaving agents to run unsupervised, and we can escalate directly to Sophos engineering on a live incident instead of joining a public support queue. Certification is not a logo. It is an escalation path and a set of trained people.
What good looks like
EDR deployed on every workstation and server, centrally managed and monitored, with alerts going to someone whose job it is to act on them.
Red flag
Free antivirus, or paid EDR that nobody is actually watching the console for.
06
Must have
How do I know my backups actually work?
You restore one and watch it happen. A backup that has never been restored is an assumption. The only evidence that counts is a test restore performed in front of you within the last twelve months.
Two blind spots are almost universal in small business.
- Microsoft 365. Many owners assume Microsoft backs up their email and SharePoint. Microsoft operates the platform and protects it from their failures. It does not protect you from a staff member deleting a mailbox, or from ransomware encrypting files that then sync to the cloud. Microsoft 365 backup is a separate product and a separate line item.
- The restore itself. Backups that report success every night can still be unrestorable, because success means “the job completed”, not “the data is intact and recoverable within an acceptable window”.
Ask for two numbers: your recovery point objective (how much data you would lose) and your recovery time objective (how long until you are working again). If your provider cannot state both, the backup has not been designed. It has been installed.
Essential Eight
Regular backups are Essential Eight strategy eight. Maturity Level One expects backups of data, software and configuration settings, retained and tested through restoration at least once.
What good looks like
Backups covering servers, endpoints and Microsoft 365, with a documented restore process, stated RPO and RTO, and a test restore within the last year.
Red flag
Green ticks on a dashboard, no test restore anyone can remember, and no Microsoft 365 coverage.
07
Must have
Do I need a firewall for my small business?
Yes, and the modem your internet provider supplied does not count. A business-grade firewall does content filtering, intrusion prevention and VPN termination, and it receives security firmware updates. Consumer modems generally do none of this.
The common objection is that everything lives in the cloud now, so the office network matters less. That is half true, and it is the wrong half. Your staff still work from an office network, still plug in devices, and still have a printer, a NAS, a security camera and possibly an EFTPOS terminal sharing that network. Each of those is a device with firmware that nobody patches.
What a business firewall gives you that a modem does not:
- Segmentation, so guest wifi and cameras cannot reach the accounting server.
- Intrusion prevention that inspects traffic rather than merely routing it.
- Proper VPN termination for remote staff, plus logs that matter enormously on the day you need to reconstruct what happened.
One maintenance point that catches people out: firewalls carry subscriptions. An out-of-licence firewall stops receiving threat intelligence updates and quietly degrades into an expensive router.
What good looks like
A business firewall with a current subscription, segmented networks, maintained firmware, and logs retained somewhere useful.
Red flag
The ISP-supplied modem, a flat network where the security camera can reach the file server, and an expired licence.
08
Must have
Should staff have administrator rights on their computers?
No, and neither should you, for day-to-day work. Restricting administrative privileges is one of the Essential Eight, and it limits how far an attack can spread from whichever account it first compromises.
When a user with admin rights opens a malicious attachment, the malware inherits those rights: it can install software, disable security tooling and reach other machines. When a standard user does the same thing, the blast radius is dramatically smaller.
The workable pattern is separate accounts. Everyone, including the owner, works from a standard account. Administrative accounts are separate, used only for administrative tasks, never used for email or browsing, and always protected by MFA. Where staff genuinely need to install software occasionally, privilege elevation handles the exception without handing over permanent rights.
Essential Eight
Restricting administrative privileges is Essential Eight strategy five. Maturity Level One expects privileged accounts to be validated on first request and prevented from accessing the internet, email and web services.
Related, and frequently the same conversation: our post on password management for business covers the credential side of the same problem.
What good looks like
Standard accounts for daily work, separate MFA-protected admin accounts, and a documented process for temporary elevation.
Red flag
Every user is a local administrator, and the owner’s account is a global admin used for daily email.
09
Must have
Does staff cyber security training actually work?
Yes, when it is short, regular and measured. Annual slide-deck training does very little. Brief monthly refreshers combined with simulated phishing measurably reduce click rates, because they build a habit rather than deliver a lecture.
Your staff are not the weakest link so much as the largest surface. Every control above reduces the chance that a mistake becomes an incident, but somebody still has to decide whether the invoice from a familiar supplier is genuine.
What works:
- Simulated phishing campaigns that show you a real click-rate number, and let you watch it fall.
- Training delivered in short units rather than an annual block.
- A culture where reporting a click is rewarded, not punished. The part most organisations get wrong.
The most expensive incidents are the ones somebody noticed early and was too embarrassed to mention.
Worth briefing your team on specifically: attacks now include convincing voice cloning. Our post on AI voice scams in Australia is a useful five-minute read for anyone who approves payments.
What good looks like
Monthly micro-training plus simulated phishing with a tracked click-rate, and a no-blame reporting process.
Red flag
One induction slide deck, never repeated, with no measurement of whether it changed anything.
10
Must have
What do I do if we actually get breached?
Follow a plan you wrote before it happened. A one-page incident response plan naming who to call, what to disconnect, and who must be notified is worth more at 2am than any product you could buy.
The plan does not need to be long. It needs to answer five questions:
- Who declares an incident?
- Who do we call first? Your IT provider, with an after-hours number that has been tested.
- What do we disconnect, and what do we deliberately leave running for evidence?
- Who talks to staff, customers and insurers?
- What are our legal notification obligations?
On that last point, Australian businesses covered by the Privacy Act have obligations under the Notifiable Data Breaches scheme, which requires assessment and notification within set timeframes when a breach is likely to result in serious harm. Serious incidents can also be reported to the ACSC through ReportCyber.
Print the plan. Networks and mailboxes are exactly the things that may be unavailable during the incident it was written for.
What good looks like
A one-page plan, printed, with tested after-hours contacts, defined roles, and notification obligations written out.
Red flag
A plan that exists only as a file on the file server that has just been encrypted.
Where to start if you cannot do all ten
Working through a small business cyber security checklist is a programme, not a weekend. If you are starting from close to zero, this is the order that removes the most risk for the least effort:
- Turn on MFA everywhere. Free on licences you already hold, and it blocks the most common attack outright.
- Test a restore. Not a backup report, an actual file and an actual mailbox, restored while you watch.
- Write the incident response plan. One page, printed. It costs an hour and it is the thing you will be most grateful for.
- Then work down the rest in order. Patching and email authentication next, endpoint and firewall after that, training running continuously alongside.
If you would like a baseline before you start, an IT audit establishes where you actually sit against each item, and we publish the minimum standards we hold every supported environment to. Ongoing coverage of all ten sits inside our managed IT services, and you can trial our support free for 14 days first.
The honest version
Most small business breaches are not sophisticated. They are a password without MFA, or a patch nobody applied.
SouthEast IT · Parkdale, Victoria
About the provider
About SouthEast IT
SouthEast IT provides managed IT and cyber security services to small and medium businesses across Melbourne and Australia, from 1/361 Nepean Highway, Parkdale VIC 3195.
- 95+ years of combined IT experience across the team, with 20+ years operating as a business
- 650+ businesses supported across Melbourne and Australia
- 4.7 Google rating from 42 customer reviews
- Certified across Microsoft, MYOB, 3CX and Sophos. Sophos accreditation means centrally managed EDR and direct vendor escalation during an incident.
- Security controls including MFA, EDR, managed patching, dark web scans, email authentication and user awareness training are built into our managed service plans from $99 per seat per month
- Hours of service: Monday to Friday, 8:30am – 6:00pm, with after-hours cover available
- Contact: 1300 155 285
See our cyber security services and managed security bundles for what each control looks like in practice.
Frequently asked questions
What is the Essential Eight for small business?
The Essential Eight is a set of eight cyber security mitigation strategies published by the Australian Signals Directorate: application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups.
It is mandatory for federal government entities and voluntary for businesses, but it is the recognised Australian benchmark. Most small businesses should aim for Maturity Level One, where the majority of the risk reduction occurs.
Do I need a firewall for my small business if everything is in the cloud?
Yes. Even with cloud-hosted email and files, your office network still carries staff devices, printers, NAS units, security cameras and payment terminals, many of which run firmware that is rarely patched.
A business-grade firewall provides network segmentation, intrusion prevention, VPN termination and logging. An ISP-supplied modem generally provides none of these, and it does not receive security firmware updates.
Is Microsoft 365 email security enough on its own?
The built-in filtering is a reasonable baseline for inbound threats, and it improves significantly when Defender policies are tuned rather than left at defaults.
It does not configure your outbound domain authentication. SPF, DKIM and DMARC records must be set up separately, and without them an attacker can send email that appears to come from your domain. Most small businesses have SPF partially configured and no DMARC record at all.
Does Microsoft back up my Microsoft 365 data?
No, not in the way most businesses assume. Microsoft protects the platform from its own infrastructure failures, but it does not protect you from accidental deletion, malicious deletion by a departing staff member, or ransomware that encrypts files which then sync to the cloud.
Microsoft 365 backup is a separate product and a separate cost, and it should cover Exchange, SharePoint, OneDrive and Teams.
How much does cyber security cost for a small business in Melbourne?
Most of the core controls are configuration rather than purchase. MFA is included in Microsoft 365 licences, restricting admin privileges is free, and writing an incident response plan costs an hour.
The items with a real cost are EDR, managed patching, Microsoft 365 backup, a business firewall and training. At SouthEast IT these are bundled into managed plans from $99 per seat per month rather than sold individually.
How often should staff do cyber security training?
Short monthly refreshers work considerably better than an annual session, because they build a habit rather than deliver a one-off lecture.
Pair training with simulated phishing so you have a measurable click-rate to track, and make reporting a mistake blameless. The costly incidents are usually the ones someone noticed early and was too embarrassed to report.
What should I do first if I suspect a breach?
Call your IT provider immediately and follow your written incident response plan. Disconnect affected devices from the network but do not wipe or rebuild them, because that destroys the evidence needed to understand what happened and what was accessed.
Assess your obligations under the Notifiable Data Breaches scheme if personal information may be involved, and consider reporting the incident to the ACSC through ReportCyber.
Want someone to check these ten for you?
We will work through the checklist against your actual environment and tell you which items you already meet, which need attention, and what each one would cost to fix. If you are in good shape, we will say so.
Call 1300 155 285, Monday to Friday 8:30am – 6:00pm. You will always speak to a trained IT support person.
Jumei Lin is the founder of Lumeio, a Melbourne-based AI decision and automation consultancy. Lumeio built the ticket triage system that sits behind SEIT’s operational workflow, handling sentiment detection and technician scoring before a human ever touches the ticket. She works with SMEs across Australia on similar problems, where a small amount of automation removes a lot of manual triage.
