A House select committee examining cyber security for small and medium-sized businesses holds its final public hearings on 2 and 4 November. Over the two sessions it will hear from eight sectors: insurance, telecommunications, health, education, early childcare, finance, legal and IT.
The committee chair, Sally Sitou MP, summarised the evidence so far in one line: support for small businesses should be “actionable, targeted and accessible.”
That is the right diagnosis. Most small businesses do not have a knowledge problem. They have a prioritisation problem. They have been told to do everything, all at once, by people selling them something — so they do nothing.
Why this matters now
The ASD received more than 84,700 cybercrime reports in 2024–25, roughly one every six minutes. The average self-reported cost to a small business was $56,600, up 14% on the year before. That figure only counts the businesses that noticed and reported. It does not count the fortnight of disruption, the lost customers, or the insurance excess.
What “actionable” actually looks like
If we were giving evidence, this is what we would say. Not a framework. A short list, in order, that a business owner can hand to whoever looks after their IT on Monday morning.
1. Turn on multi-factor authentication for every account that matters. Email, remote access, accounting software, banking, and every admin account. Where you can, use phishing-resistant methods such as an authenticator app with number matching or a hardware key, rather than SMS codes. This one step closes the most common way in.
2. Clean up who has access to what. Remove accounts for people who have left. Take admin rights away from day-to-day accounts. Review who can reach shared drives and finance systems. Most small businesses we look at have at least one active account belonging to someone who left years ago.
3. Patch, and retire what can’t be patched. Keep operating systems and applications current. Then find the things that no longer receive updates — the old server in the cupboard, the firewall nobody has logged into since installation, the Windows 10 PC in the back office — and plan to replace them.
4. Have backups you have actually restored from. Stored offline or in a form that ransomware cannot alter. A backup that has never been tested is a hope, not a control.
5. Turn on logging, and make sure someone looks at it. When something goes wrong, the first question is always “what happened, and when?” Without logs, nobody can answer it.
These map directly onto the ACSC’s Essential Eight. You do not need to reach maturity level three across all eight controls next quarter. You need the basics done properly, in this order.
What “targeted” should mean
The committee’s focus on sector-specific needs is well placed. A medical practice, a construction company and a local club face very different risks. The practice holds health records. The builder has staff on site, on phones, approving invoices. The club trades late into the night with members’ payment details and surveillance footage.
Generic advice tends to get ignored because it does not reflect how the business actually runs. Good advice starts from what the business does and what would hurt most if it were lost.
What “accessible” should mean
Accessible does not mean another portal, another checklist or another awareness campaign. For most small businesses it means one person who knows their environment and can tell them plainly what to do first, what can wait, and what they do not need at all.
That last part matters. Much of the cyber security market sells fear and bundles. A business owner who has been quoted for a security operations centre, a compliance platform and a training subscription, all at once, will often decide it is too expensive and do nothing. The five steps above cost far less than any of those, and they stop most of what actually happens.
What happens next
The committee will report after its hearings. Whatever it recommends, nothing in the list above needs to wait for it. If you would like a second opinion on where your business stands against these five steps, we are happy to take a look — and we will tell you honestly if you are already in good shape.