Essential small business cyber security checklist for Brisbane in 2025

Most breaches hit small businesses—tackle the biggest risks in an afternoon. This guide gives Brisbane owners a plain‑English small business cyber security plan aligned to the ACSC Essential Eight. Use it to cut ransomware, invoice scams and data loss across offices, warehouses and tradie utes.

Key takeaways

• Follow the ACSC Essential Eight to cover the main attack paths.
• Turn on MFA for email, banking, accounting and remote access first.
• Patch systems monthly, and remove local admin rights for day‑to‑day use.
• 3‑2‑1 backups with quarterly restore tests stop ransomware from ruining your week.
• Train staff on phishing and invoice scams; keep a simple incident plan.

What small business cyber security is and the core concept

Definition

Small business cyber security is the set of tools, settings and habits that protect your emails, devices, cloud apps and network from scams and malware. It bundles the ACSC Essential Eight: patching, app control, macro controls, user access limits, multi‑factor authentication, hardening, backups and recovery.

Why it matters

In Brisbane, most attacks are simple: fake invoices, stolen Microsoft 365 logins, weak Wi‑Fi, or out‑of‑date PCs. Storms and power blips add risk to servers and NAS boxes. NBN dropouts push people to open risky remote ports. A short, repeatable checklist beats guesswork and keeps work rolling.

Map your risks with the ACSC Essential Eight

The Essential Eight gives a handy scorecard. Aim for Maturity Level 1 fast, then build to Level 2 for key roles (directors, finance, admins). Start with MFA everywhere, patch monthly, and lock down admin rights. Add app allow‑listing, macro controls, and strong backups. Review every quarter, or after any incident.

How it works and step-by-step

Process

Use this 10‑step cyber security checklist to lift your baseline in under a week:

• 1) Turn on MFA: Email, banking, Xero/MYOB, remote tools, VPN and admin portals. Prefer app‑based codes or push. Apply to all staff, contractors and shared mailboxes.
• 2) Patch fast: Enable auto updates for Windows/macOS, browsers, Office, Adobe, Java, drivers, routers, NAS and printers. Reboot weekly.
• 3) Limit admin: Give staff standard accounts. Use a separate named admin account only when needed. Block PowerShell and unsigned scripts for non‑admins.
• 4) Backups 3‑2‑1: Three copies, two media, one offsite. Keep an offline or immutable copy. Test file restores each quarter.
• 5) Email security: Set SPF, DKIM and DMARC. Turn on anti‑phishing and malware policies. Block macros from the internet.
• 6) Application control: Allow‑list business apps. Remove old Java/Flash and toolbars. Block unknown .exe, .bat and .ps1 downloads.
• 7) Remote access: Close RDP port 3389 on the modem. Use a VPN with MFA. Remove old remote tools you no longer use.
• 8) Endpoint protection: Use business‑grade EDR with automatic quarantine and web control. Turn on disk encryption (BitLocker/FileVault).
• 9) Network basics: Change default passwords on modem, Wi‑Fi and cameras. Use WPA3. Separate guest Wi‑Fi and smart devices from work PCs.
• 10) People and process: Run 15‑minute phishing refreshers each quarter. Do a ransomware drill. Document who to call and how to isolate gear.

Featured answer

For a Brisbane SME in 2025, follow the ACSC Essential Eight: turn on MFA, patch monthly, remove daily admin rights, allow‑list apps, block risky macros, deploy business‑grade EDR, run 3‑2‑1 backups, and test restores quarterly. Add a short incident plan and phishing training. This blocks the common attack paths and speeds recovery.

Low‑cost tools we recommend (and what to avoid)

• Password manager: Use a team plan with shared vaults (finance, admin). Look for audit logs and breach alerts. Avoid saving passwords in spreadsheets.
• MFA apps: Use Microsoft or Google Authenticator, or platform prompts. Hardware security keys are great for admins and finance.
• Email filtering: Turn on built‑in Microsoft 365 or Google Workspace anti‑phish. Add an allow‑list for trusted suppliers and block executable attachments.
• Endpoint protection: Microsoft Defender for Business (in M365 Business Premium) is solid value. Other good EDR options exist if you don’t use Microsoft 365.
• Patching: Use Windows Update, macOS Auto Update and a lightweight updater for third‑party apps. Schedule reboots after hours.
• Backups: Use a NAS plus encrypted cloud backup, or laptop/server agents that back up direct to cloud. Keep one offline or immutable copy.
• DNS filtering: A simple, low‑cost filter blocks malware sites and typosquat domains before clicks cause grief.
• Avoid: Free “antivirus” bundles, pirated software, open RDP, and random USBs. These often cause infections or data leaks.

Backup, recovery and incident response basics

Pick recovery targets that match the business. Many Brisbane shops aim for RPO of 24 hours (you can lose up to a day of data) and RTO of four hours (back up and running same morning/afternoon). For POS or warehouses, aim tighter. Do a quarterly restore test and note the time taken.

During an incident: isolate the device from Wi‑Fi/NBN, photograph messages or ransom notes, note the time, and call your bank if money moved. Report staff impacts to your manager, then start your incident checklist. After recovery, review what worked and update your steps.

Common problems in Brisbane

Weather and infrastructure

• Heat and humidity shorten device life. Storms (Nov–Mar) bring power spikes. Use a UPS and surge diverters on servers, NAS and modems.
• Older buildings in the CBD, West End and Woolloongabba often have patchy cabling. Expect Wi‑Fi dead zones and plan extra access points.
• NBN quirks: FTTN dropouts hit Jindalee, Mt Gravatt and parts of Logan. Consider 4G/5G failover on the router for phone and EFTPOS continuity.
• Industrial estates in Brendale, Sumner and Capalaba see dusty racks and hot sheds. Clean filters and add fans to keep gear stable.

Troubleshooting and quick checks

Short answer

If you suspect a breach, disconnect the device from Wi‑Fi or unplug Ethernet, then do a quick scan with your endpoint tool. Change your email password and turn on MFA if it’s not already set. Check your last backup worked. If you see a ransom note, stop and call a local pro.

Quick checks

Try these safe checks now:

• Windows/macOS: Run pending updates; reboot after install.
• Microsoft 365/Google: Confirm MFA is on for all users, including shared mailboxes.
• Admin rights: Staff should be standard users. Create a separate named admin account for IT tasks.
• Backups: Restore a single file from last week to a test folder.
• Email security: Check SPF/DKIM/DMARC are set and passing.
• Router: Make sure RDP (3389) is not open to the internet.
• Wi‑Fi: Use a guest network for visitors and smart devices.
• Training: Send a reminder about invoice scam red flags this week.

Safety notes and when to call a pro

Red flags

Get help fast if you see repeat sign‑in alerts from other countries, missing funds, files with strange extensions, apps asking for admin approval you didn’t request, or your antivirus keeps quarantining new items. If your backups won’t restore cleanly, pause changes and call a local Brisbane specialist.

Local insights and examples

Brisbane/SEQ examples

We often see Fortitude Valley studios on Macs with Microsoft 365, North Lakes trade teams on rugged Windows laptops in utes, and Capalaba workshops with a NAS in a hot mezzanine. Common wins are simple: MFA for directors and finance, a UPS for the NAS, and closing old remote ports left open after COVID.

During storm season, Springfield Lakes and Ipswich sites benefit from 4G failover and cloud file sync so staff can work from home. In shared offices around Milton and South Brisbane, a separate guest VLAN keeps IoT gear off your work network. Short, repeatable steps make these setups safer without big spend.

FAQs

Q1: What password rules work best for small teams?

Use long passphrases (14+ characters) and a team password manager. No need for monthly forced changes; change on breach, role change or when shared. Turn on MFA everywhere. Avoid sharing one login for staff; use named accounts so you can track and remove access quickly.

Q2: Which MFA should we pick and how do we roll it out?

Use app‑based codes or push prompts. Keep SMS only as a backup. Give hardware keys to admins and finance. Roll out in waves: IT and owners first, then finance, then the rest of the team. Share a one‑page guide and offer a quick toolbox talk.

Q3: Is free antivirus enough for a business in 2025?

No. Use business‑grade endpoint detection and response with web control and device encryption. Turn on automatic actions like quarantine. Pair it with patching, MFA and backups. Add short phishing training each quarter so people spot dodgy links and invoice scams.

Sources and further reading

The ACSC Essential Eight sets a practical baseline across patching, access control, macros, app allow‑listing and backups, measured at three maturity levels. The NIST Cybersecurity Framework maps risk, detect and response phases. The 3‑2‑1 backup rule guides safe copies. ReportCyber and Scamwatch outline local scam patterns.

Wrap-up and next steps

Start with MFA, patching and backups, then chip away at the rest of the ACSC Essential Eight. Keep a one‑page incident plan and test a file restore each quarter. If you want local help or a quick health check, see: Service:
Computer & Network Security