Cyber Security Strategy Australia: What to Do First
For most Australian businesses under a hundred staff, the right cyber security strategy starts with four things: multi-factor authentication on email and remote access, patching anything facing the internet, backups you have actually restored from, and a written list of what data you hold and where. Do those before you look at a framework. They close the paths used in the majority of incidents, they cost little, and every standard you might later certify against assumes them anyway.
The harder question is what comes after that, and in what order. The answer depends almost entirely on what is forcing your hand.
What should a cyber security strategy for an Australian SMB actually contain?
A cyber security strategy for a business of five to a hundred people does not need to be a document. It needs to be a short set of decisions written down: what you are protecting, what you are protecting it from, what you will do in the next twelve months, what you have consciously decided not to do yet, and who owns each item.
The reason most SMB security strategies fail is not that they pick the wrong controls. It is that they contain forty items with no owner and no order, so the easy ones get done and the important ones wait. A strategy that names six things and the person responsible for each beats a forty page document every time.
What is forcing your hand, and what should you do first?
The single most useful question in Australian SMB security planning is why you are thinking about this now. The honest answer almost always points at the right first move, and it is rarely a framework.
The row that catches businesses out is the tender or contract one. Commercial agreements frequently reference a standard without requiring certification against it. A clause asking you to maintain controls consistent with ISO 27001 is a very different obligation to one requiring a current certificate. Read the clause before you budget for a certification project you may not need.
What order should an Australian SMB do security work in?
Sequencing matters because the work compounds. Fixing the environment first makes certification faster and cheaper. Certifying first means paying an auditor to document problems you then have to fix anyway.
Months one to three: close the common paths
Multi-factor authentication on email, remote access and any administrative console. Patching for anything reachable from the internet. Backups that have been restored from in a test, not just reported as successful. A written inventory of what personal and customer data you hold, where it lives and who can reach it.
That last one does double duty. It is the foundation of every framework you might later adopt, and it is what you will desperately need on day one of an incident. Under the Notifiable Data Breach scheme, you have thirty days to assess a suspected eligible breach and must notify the Australian Information Commissioner and affected individuals if it is likely to cause serious harm. Working out what data you held, after the fact, is what burns most of that window.
Months four to six: prove it to someone outside the business
Internal confidence is not evidence. An external penetration test against whatever your customers actually touch, whether that is a web application, an API or your corporate network, tells you what an attacker would find, and gives you a report a buyer will accept. Then fix what it found, which is the step that gets skipped.
This is also the point to write the small number of policies you will actually be asked for: acceptable use, access control, incident response, data handling, supplier security and business continuity. Six policies that reflect how you work are worth more than thirty downloaded templates that do not.
Months seven to nine: pick a framework, if you need one
Choose the framework your buyers ask about, not the one with the best marketing. In Australia that usually means SOC 2 if you sell software to technology companies, ISO 27001 if you sell to enterprise or government-adjacent buyers, Essential Eight if you work with government, and DISP if you work in Defence. ISO 27001 versus Essential Eight and SOC 2 versus ISO 27001 cover the comparisons properly. For smaller businesses that need to show something credible without a full certification project, SMB1001 certification is worth a look.
How should you track controls and evidence?
Once you have picked a framework, you need somewhere to hold the control list, the policies and the evidence. A spreadsheet works for a small scope and costs nothing, though it degrades as soon as more than two people touch it. A consultant running the project keeps it organised for you and is the most flexible option. An enterprise compliance platform such as Vanta or Drata automates evidence collection through deep integrations with your systems, which suits larger teams. A lighter alternative is a tool like CertAssist, built by a separate company founded by members of the Siege Cyber team, which lists US$375 per month and deliberately has no integrations, so it holds no access to your systems. The trade-off is automation on one side against simplicity on the other.
Whichever you choose, the tool is not the strategy. Whether you still need a consultant if you use Vanta or Drata covers where tooling stops and judgement starts.
Months ten to twelve: go for the certificate
Internal audit, book the certification body early, run the evidence period, then the audits. By this stage the work is administrative rather than technical, which is exactly how it should be. If the certification phase is still surfacing security problems, the first nine months were skipped.
What should you deliberately not do yet?
A strategy is as much about what you decline as what you commit to. These are the items Australian SMBs most often buy too early.
| Commonly bought early | Why it usually waits | Do this instead for now |
|---|---|---|
| A 24/7 managed detection service | Expensive, and useless if nobody can act on an alert at 2am | Centralise logging and agree who gets called |
| A full ISO 27001 project | Certifying a weak environment costs more and takes longer | Fix the environment, then certify |
| Advanced email security tooling | Most of the benefit is already in your existing platform | Turn on what you are paying for and enforce MFA |
| A dedicated security hire | Hard to recruit, hard to retain, hard to justify under 100 staff | Fractional or vCISO support, scaled to the work |
| Cyber insurance before controls | Premiums and coverage both depend on controls you have not built | Get MFA, backups and patching done first |
The vCISO row is the one worth dwelling on. Most businesses under a hundred staff need security judgement a few days a month, not a full-time salary. vCISO versus a full-time CISO covers where the line sits, and our first 90 days as your vCISO covers what the work looks like in practice.
Common questions about cyber security strategy
How do you develop a cyber security strategy for a small business?
Start with what you hold and who wants it, not with a control framework. Write down your data, your systems and your legal obligations, then identify the three ways a realistic attacker would most likely get in. Pick controls that close those three paths, assign an owner and a date to each, and review it quarterly. A one page strategy that gets reviewed beats a thorough one that does not.
When should an organisation reassess its cyber security strategy?
Quarterly as a light review, annually as a proper reassessment, and immediately after four specific events: an incident or near miss, a significant change to your systems or cloud platform, a new regulatory obligation that applies to you, or a new class of customer with different security expectations. Those four events change your risk picture faster than the calendar does.
How much should an Australian small business spend on cyber security?
There is no reliable percentage, and figures quoted as industry averages rarely survive scrutiny. A more useful approach is to work out what the first twelve months of the sequence above would cost for your specific environment and compare it against the cost of a week of downtime or a lost contract. Most SMBs find the groundwork costs far less than they feared, and the certification phase costs more.
What security measures should every Australian business have in place?
Multi-factor authentication on all remote and administrative access, patching of internet-facing systems, tested backups with an offline or immutable copy, a data inventory, and a written incident response plan naming who makes decisions. These five appear in every framework and underpin everything else. An Essential Eight maturity assessment is a practical way to measure where you sit against the Australian baseline.
Do we need a framework at all?
Not necessarily. If nobody is asking for certification and you do not operate in a regulated sector, you can run a strong security programme without certifying anything. What a framework buys you is a structured control list and a credential your customers recognise. If neither of those is solving a problem you currently have, spend the budget on controls instead and revisit it when a buyer asks.
Turning a cyber security strategy into something that happens
The difference between businesses that improve and businesses that stay where they are is rarely budget. It is whether the work has a named owner and a date. A strategy with six items, each with a person and a deadline, will outperform a comprehensive programme that belongs to everyone.
Review it quarterly, be honest about what did not get done, and move it or drop it rather than carrying it forward silently. A strategy that shrinks to what you can actually deliver is a working strategy. A strategy that grows every quarter is a wish list.
Siege Cyber works with Australian businesses on exactly this sequencing, from first assessment through to certification. If you want help deciding what to do first for your own situation, see our cyber security advisory services or get in touch.