Skip to content
Independent publication by Content Authority. Not affiliated with or endorsed by any government body.
NSW Growth AuthorityIndependent business intelligence

Business Resilience

Cyber Security Checklist for NSW Small Businesses

Published November 9, 2026 · Updated November 9, 2026 · By NSW Growth Authority Editorial Team

Cyber security is a business continuity issue, not only an IT task. A compromised email account, fraudulent invoice, lost device or unavailable website can interrupt sales, expose customer information and damage trust.

Service NSW recommends practical controls including staff education, secure backups, current software, strong unique passwords and multi-factor authentication. The checklist below turns those principles into an owner-level review.

Protect the accounts that control the business

  • Enable multi-factor authentication on email, banking, accounting, website, domain and social-media accounts.
  • Use a password manager and a different password for every service.
  • Remove access promptly when a staff member or supplier no longer needs it.
  • Keep an owner-controlled record of who administers each critical account.

Make backups recoverable

Back up important business data and keep at least one copy separate from the everyday system. A backup is not proven until the business has tested that it can restore the information. Record the restoration steps so recovery does not depend on one person.

Reduce preventable weaknesses

Apply security updates to computers, phones, website software, routers and business applications. Replace unsupported technology. Train staff to verify unexpected payment requests using a known contact method rather than replying to the message that requested the change.

Prepare an incident response card

Keep a short, accessible list of the first actions: disconnect affected devices where appropriate, contact the IT provider, secure accounts, preserve evidence, notify the bank if money is at risk and assess whether privacy or regulatory notifications are required. Professional legal, privacy or cyber advice may be necessary.

Primary guidance: Service NSW common cyber security risks. For broader planning, use our NSW business growth resources.

Source note: Verify current eligibility, dates and requirements with the linked primary source. Contact us if material information has changed.