Cyber Security Action Month: Five Steps for Small Business

For years, October has been Cyber Security Awareness Month. In 2026 the Australian Government renamed it Cyber Security Action Month. It’s a small change with a clear message: most small and medium businesses already know the risks. What’s missing is follow-through.

The month sits inside a wider Australian Signals Directorate program called Cyber Action Year 2026. It asks organisations to plan on the basis that a cyber compromise is a matter of “if, not when.” Insurers, auditors and larger clients already think about their suppliers this way, so it’s a useful lens for any business that wants to keep winning work.

Knowing isn't the same as doing

Most business owners know they should have multi-factor authentication, and many already use it for email. More and more apps are making it a compulsory part of logging on to accounts these days. The gaps tend to be elsewhere: a shared admin login, an old accounting portal, a supplier system nobody has checked in years.

Those gaps are where incidents happen. The Australian Signals Directorate received over 84,700 cybercrime reports in 2024-25, roughly one every six minutes. The average self-reported cost was $56,600 for a small business, up 14%, and $97,200 for a medium business, up 55%.

Security work rarely feels urgent until something goes wrong. It competes with client deadlines, hiring and month-end, and it usually loses. A month named for action is a good reason to put two or three items in the calendar and see them through.

Five cybersecurity actions for small businesses this month

Here are five actions that line up with the basics the that the October campaign promotes, in the order we’d tackle them:

  1. Turn on multi-factor authentication Start with email and Microsoft 365, then cover banking, payroll, accounting software and remote access. Authenticator apps and passkeys are stronger than SMS codes.
  2. Test your backups. Until you’ve restored from a backup, you don’t know it works. Pick one important folder or system and restore it this month. Make sure at least one copy is kept separately from your main environment, where ransomware can’t reach it.
  3. Update your software patches promptly, and plan for what can’t be patched. Updates to operating systems, browsers and apps close known holes. The ASD’s latest threat report also asks organisations to replace legacy technology or put mitigations in place. That old server running one critical application belongs on your list.
  4. Write down what happens on the worst day. An incident response plan can be short. It needs names, phone numbers, who calls the insurer, who talks to clients and where the backups are. Keep a printed copy, because during an incident your email may be unavailable.
  5. Teach people to pause. The campaign tagline, “Take a second. Stay secure” is good staff training advice. Show people how to verify payment changes by phone, spot suspicious messages and report them quickly. Make it clear that reporting a mistake early is always welcome.
Cyber Security Action Month Infographic

The question your board will ask

If you’re accountable for technology in your business, try this: if we were breached tomorrow, what would happen in the first hour? Who would you call? Could you still invoice, pay staff and talk to clients?

If the answers are vague, you’ve found your starting point. A tabletop exercise, where your leadership team walks through a realistic scenario together, surfaces gaps faster than almost anything else. It also turns an abstract risk into a set of decisions people have already practised.

It’s also worth checking your cyber insurance policy while you’re there. Many policies list conditions, such as multi-factor authentication or tested backups, that need to be in place for a claim to succeed. Knowing those conditions now is far better than discovering them mid-incident.

From actions to proof

The five actions above make you safer. More and more, clients, insurers and tender panels also want you to prove it. Frameworks such as the Essential Eight and SMB1001 help here: they turn good intentions into a structured program with evidence you can show someone else.

We went through this ourselves when Grassroots IT achieved SMB1001 Gold certification. Over about six months, the biggest surprise was how much good practice we already had in place that simply wasn’t documented, so most of the work was writing it down and making it auditable.

Cyber Security Action Month runs until the end of October. It’s a great time to choose one action from this list and finish it before then. Then pick the next one.

SOURCES