IN THIS GUIDE
- 01Know what the business relies on
- 02Strengthen identity and access
- 03Keep devices and software maintained
Know what the business relies on
Start with the systems, devices, accounts and information that would interrupt the business if they became unavailable or untrusted. Include services managed by individual teams and suppliers. A useful asset view makes later security decisions specific instead of generic.
Strengthen identity and access
Accounts connect people to almost every modern business system. Review who has access, how sign-in is protected, which permissions are broader than the role requires and what happens when someone joins, changes role or leaves. Shared accounts and forgotten access deserve particular attention.
Keep devices and software maintained
Security updates, supported software, device configuration and reliable backups are ordinary operational work. Assign responsibility and establish a repeatable process. A control that exists in a document but is not maintained will become less useful over time.
Prepare for a difficult day
Write down how the business will recognise, report and respond to a suspected incident. Identify who makes decisions, which suppliers need to be involved and how essential work can continue. Test the plan with a realistic scenario so gaps appear before the response is urgent.
Turn the review into priorities
A long list of possible improvements can stall progress. Order the work by business impact, exposure and dependency, then give each action an owner. Novasoft combines cybersecurity services with managed IT and CyberGuardian where that fits the operating environment.
Include personal information in the asset view
Understand what personal information the business collects, where it moves and who can access it. Security, privacy and retention decisions are connected. Obtain appropriate advice about the organisation’s obligations under Australian privacy law.
Measure whether controls operate
A policy or licence does not prove a control is working. Review evidence such as update status, authentication coverage, restore tests, access reviews and incident exercises. Record exceptions and assign the next action.
USE THIS IN PRACTICE
A first security review should cover
- 01
Important systems, information and business dependencies.
- 02
Multi-factor authentication and privileged access.
- 03
Supported software, updates and device configuration.
- 04
Backups, restore testing and continuity plans.
- 05
Staff reporting, incident contacts and response exercises.
- 06
Supplier access and responsibility boundaries.
Common questions
Does this checklist guarantee security or compliance?
No. It is a starting point for prioritising work. Security and compliance depend on the organisation’s environment, obligations and maintained practices.
Where can an Australian small business find official guidance?
The Australian Signals Directorate publishes a small-business cyber security guide and the Essential Eight through cyber.gov.au.
EXPLORE THE SOURCE
EXPLORE THE RELATED CAPABILITY
Cybersecurity
Practical cybersecurity services for organisations worldwide: assess exposure, improve controls and prepare your team to respond.
Explore Cybersecurity