The 2026 Small Business Cybersecurity Baseline: 10 Controls You Should Have in Place

A solid 2026 cybersecurity baseline for an Australian small business covers 10 controls: phishing-resistant MFA, regular patching, tested backups, limited admin access, endpoint protection, email security, staff training, good password habits, secured devices and networks, and a rehearsed incident response plan.

None of these are exotic. They're the everyday basics that stop most attacks, and the businesses that skip them are the ones that end up in the news.

Why a baseline matters right now

Small businesses aren't flying under the radar. ASD received more than 84,700 cybercrime reports in 2024–25, about one every six minutes. The average self-reported cost for a small business rose 14% to $56,600. ASD also responded to over 1,200 cybersecurity incidents, an 11% increase on the year before.

The rules have shifted too. Since 30 May 2025, Australian businesses with annual turnover above $3 million have had to report ransomware payments within 72 hours. According to the Department of Home Affairs, that regime moved from an education-first approach to active compliance and enforcement from 1 January 2026. The test is turnover, not industry, so a 40-person firm can be caught as easily as a large one.

A baseline gives you a clear, achievable target. The ten controls below line up with the thinking behind the ASD's Essential Eight, the government's recommended set of mitigation strategies.

The 10 controls at a glance

1. Phishing-resistant multi-factor authentication (MFA)

Passwords alone are no longer enough. Start with MFA on email, cloud platforms, accounting software, and remote access.

Where you can, move beyond SMS and basic app codes to passkeys or security keys. ASD brought phishing-resistant MFA into the Essential Eight at Maturity Level 2 in November 2023. Begin with admins, owners, and anyone who approves payments.

techbrain

2. Regular patching and updates

Attackers love old software because the flaws are already public. Keep operating systems, browsers, business apps, routers, and firewalls up to date.

• Turn on automatic updates wherever possible.

• Set a regular patching schedule for servers and network gear.

• Retire software that's no longer supported.

3. Backups you've actually tested

A backup you've never restored is a hope, not a plan. Aim for the 3-2-1 approach:

• Three copies of your important data

• Two different storage types

• One copy is kept offline or immutable, so ransomware can't touch it.

Then test a restore at least quarterly. Knowing you can recover quickly changes how you respond to an attack.

4. Limited administrator access

Not everyone needs the keys to the kingdom. Give people only the access their job requires.

• Use separate admin accounts, not everyday logins.

• Review who has admin rights every quarter.

• Remove access immediately when staff leave or change roles.

5. Endpoint protection and application control

Every laptop, desktop, and server needs modern protection that goes beyond basic antivirus. Look for tools that detect suspicious behaviour, not just known malware, and that can isolate an infected device quickly.

Application control, which only lets approved software run, is another strong layer. It's one of the Essential Eight strategies for a reason.

6. Email security and payment verification

Business email compromise is a leading cause of financial loss for Australian businesses, and invoice fraud is a favourite trick. Layer your defences:

• Spam and phishing filtering

• SPF, DKIM, and DMARC records to protect your domain from spoofing

• A firm rule that bank detail changes are always confirmed by phone, using a number you already hold

That last step costs nothing and prevents a lot of heartache.

7. Regular staff security training

Your team is both your biggest risk and your best protection. Short, regular training beats an annual slideshow.

Cover the essentials: spotting phishing, reporting suspicious messages without fear of blame, handling sensitive data, and recognising unusual payment requests. Simulated phishing emails help people practice safely.

8. A password manager and good account hygiene

Reused and shared passwords are a gift to attackers. A business password manager lets staff use long, unique passphrases without remembering them all.

• Ban shared logins where possible.

• Disable accounts of former staff the same day they leave.

• Check regularly for leaked credentials linked to your domain.

9. Secure devices and networks

Work happens everywhere now, so protect devices as well as the office.

• Encrypt laptops and phones.

• Use a business-grade firewall and keep it updated.

• Separate guest Wi-Fi from your business network.

• Set up remote wipe for lost or stolen devices.

• Manage mobile devices that access company email.

10. An incident response plan and 24/7 monitoring

When something goes wrong, the first hour matters. Write down who does what, who to call, and how you'll communicate with staff and customers.

Your plan should also cover your legal duties. If you're covered by the Privacy Act, the Notifiable Data Breaches scheme may apply. If your turnover exceeds $3 million, the ransomware payment reporting clock starts from the moment a payment is made, or you become aware of it. Name a person responsible for each step, and run a simple tabletop exercise once a year.

minterellison

Monitoring is the other half. Attackers don't keep business hours, and an alert at 2am that nobody sees helps no one.

Where should a small business start?

Don't try to do all ten at once. Here's a sensible order:

• This Week: MFA on email and admin accounts, and a check that your backups restore

• This Month: Patching, email security, and removing old accounts

• This Quarter: Staff training, password manager, device encryption, and an incident response plan

How a managed provider can help

Many small businesses don't have an in-house IT team, and that's fine. Well-run managed IT services take care of the day-to-day work behind these controls, such as patching, monitoring, backups, and device management, for one predictable monthly fee.

Reliable IT support matters here too. When a staff member clicks something suspicious, you want to ring someone who answers promptly and explains things in plain English. That's where 24/7 support earns its keep, because the quicker an incident is spotted, the smaller it usually stays.

For deeper protection, managed cybersecurity services bring together threat monitoring, endpoint protection, vulnerability checks, and staff awareness training under one roof, so your baseline doesn't rely on one person remembering everything.

Elevate Technology supports businesses from its Brisbane headquarters, with locations in Mackay, Sydney, and Newcastle. As a Microsoft Solutions Partner for Modern Work, the team works with fixed-fee pricing and no long-term contracts.

Take the Next Step

You don't need a huge budget or a technical background to lift your security. Pick the first three controls, assign owners and set dates. If you'd like a second pair of eyes on where your business stands, Elevate Technology offers a free quote and a no-pressure chat. Call 1300 463 538 or visit elevate.au to get started.

FAQs:

1. What is a cybersecurity baseline for a small business?

It's the minimum set of security controls every business should have in place, regardless of size. For most Australian small businesses, that includes MFA, patching, backups, restricted admin access, endpoint protection, email security, staff training, password management, secure devices, and an incident response plan.

2. What are the most important cybersecurity controls for small businesses?

Start with MFA, tested backups, patching, and email security. These four stop a large share of common attacks and don't need a big budget. Staff training and an incident response plan then build on that foundation.

3. How much should a small business spend on cybersecurity?

There's no single figure, as it depends on your size and the sensitivity of your data. Many businesses find a managed provider more cost-effective than hiring in-house because the monthly fee covers tools, monitoring, and expertise. Compared with an average incident cost of $56,600 for small businesses, prevention is far cheaper.

4. What is the Essential Eight, and does it apply to small businesses?

The Essential Eight is a set of eight mitigation strategies from the Australian Signals Directorate: application control, patching applications, restricting Microsoft Office macros, user application hardening, restricting admin privileges, patching operating systems, MFA, and regular backups. It isn't compulsory for most small businesses, but it's a smart, practical benchmark.

5. Do small businesses have to report ransomware payments in Australia?

If your annual turnover exceeds $3 million, yes. You must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours. Smaller businesses aren't required to, but they can still report incidents voluntarily through ReportCyber.

6. How often should we review our cybersecurity controls?

Review them at least quarterly, and whenever staff, systems or suppliers change. Test your backups quarterly and run an incident response exercise once a year.

7. Is 24/7 monitoring worth it for a small business?

Often, yes. Many attacks begin outside business hours, when nobody is watching. Monitoring lets suspicious activity be spotted and contained early, which usually means less downtime and lower recovery costs.