Page Comparison

Read the Australian Government Small Business Cybersecurity Guide.

• Identify the areas you really don’t understand.

• Ask for some help.

Decide if SMB1001 Gold self attestation may be good fit for your business.

• Get your Technical Specialist onboard with your plan.

Heading for ISO27001? Wanting to do more government Work?

• Decide which level you would like to get to, and within what time frame.

Have a read of your current Policies and Procedures.

• Does anything stand out as needing to change?

Gather all your current policies and procedures in one place, as you will be updating them.

Think about having a centralised place to store and maintain policies and procedures. There are many options.

Think about risk in your business.

• What keeps you up at night?

• What would you do if something happened to a key piece of software or hardware?

• What if you lost your phone? Can you even pay payroll?

Start to write down some of the risk scenarios you may face as a business.

• Things going wrong

• Key people not being available

• What happened during the pandemic?

Plan to implement a risk register in the business, along with all that entails (eg updating it regularly). There are great apps to help with this.

What regulations does your business have to follow?

• Privacy Act?

• Notifiable Data Breaches?

What parts of the Privacy Act scare you? What parts don’t you understand? What do you need to ask your Technical Specialist about?

How are you staying up to date with legislation that may affect your business?

What other regulations are impacting you, eg your Suppliers or people you supply to may be subject to regulations that affect the way you do business with them.

What parts of the new Cybersecurity Legislation Package (2024) do you need to be factoring into your business?

You are going to need to start maintaining Supplier Agreements, and managing your supply chain, along with being responsible for understanding and complying with all the legislation and regulations that impact your sector.

What help do you need to get this done?

Just as you have had to check what you didn’t understand and ask for help, start this process with your team also.

https://www.cyber.gov.au/learn-basics

• No question is too silly,

• No one will be penalised for asking a question about something that looks strange,

• Let the team know that you are all together embarking on a journey to get the business better at cybersecurity.

• Talk about what ideas they have, and what areas they see as needing improvement.

• Come to an agreement on some baseline rules:

  • No more hidden data - eg spinning up a spreadsheet and then maintaining it weekly forevermore.

  • No more signing up to a new service without approval.

  • No more emailing documents and spreadsheets to anyone, including another team member.

  • No more taking data home on USB sticks.

• Take the Quiz, share the results with the team, and talk through the answers.

• Talk them through the next steps.

  • Passwords

  • Access Control

  • Application Control

• When they groan, and complain, remind them what you discovered in Step 0 - how does getting better at cybersecurity fit with your business values?

You may want a few key team members to become “cyber wardens” but take the course yourself first. Be aware that this is not everything you need to know, and it can be a bit too simplistic at times.

Talk to your IT specialist about what cybersecurity training they recommend.

Never recommend training that shows your team as the “weakest link” or the “first line of defence” or any other scare tactics. It’s your job to get your business to a position that a team member clicking on a link does not grind your business to a halt.

Training must also include Data Privacy and your obligations under the Privacy Act.

Cybersecurity training is a core part of your business.

Your team has cybersecurity training as one of their measurable points.

You may have cybersecurity training included as part of some of the software you have already.

But just watching a few videos per year, or watching a video if you happened to click on a phishing test that your IT provider sent out, is not enough.

Cybersecurity and data privacy is a key part of business as usual for you and your team, and it is a key part of your business values, and therefore you are helping your suppliers and customers with their cybersecurity challenges also.