Think about who, what, why, when:

• What data do you store?

• What data do you collect from your customers?

• Where do you store that data? (Paper? Laptop? Cloud?)

• Who in your business has access to that data?

• What do you do with that data?

• Where do you send that data?

Make lists of data, people, software, logins, hardware, devices:

• Answer the Five Knows in notes to yourself.

• Tip: If you have a Password Manager, use that as the list of Software, and make notes about what the software does, who accesses it, how much it costs, when is it due for renewal.

Start some Registers:

• A Register of Software used

• A Register of all Laptops, Phones, iPads, and any device connected to the internet. Include your home if you do a lot of work at home.

• A register of all places data is stored, and what data is stored there Eg Dropbox, Google Drive, Xero…

• Keep these registers in a place and format that can be easily updated.

Think about what would you like to be doing better?

Write down something about what being better at cybersecurity will look like.

Plan how you are going to bring your staff along on this journey.

Read the Australian Government Small Business Cybersecurity Guide.

• Identify the areas you really don’t understand.

• Ask for some help.

Decide if SMB1001 Gold self attestation may be good fit for your business.

• Get your Technical Specialist onboard with your plan.

Heading for ISO27001? Wanting to do more government Work?

• Decide which level you would like to get to, and within what time frame.