Most small business owners know cyber security matters. What they don’t know is how to tell whether the person they’re paying to handle it is actually good at the job.
That gap came up directly in a House of Representatives inquiry into cyber security for small and medium businesses this month, and it’s worth unpacking, because the stakes are real and climbing. The Australian Signals Directorate received more than 82,000 cybercrime reports in the 2025-26 financial year, roughly one every six minutes, and small businesses that reported an incident lost an average of $55,400.
Appearing before the committee for the Australian Computer Society, CyberPath Technical Program Lead Jakub Zvěřina described the problem as one of implementation rather than awareness. Businesses generally understand cyber security is important. What they struggle with is deciding which risks actually matter for them, where to spend money, who to hire, and how to confirm afterward that the work was done properly. “There’s nothing within a lot of those compliance frameworks which actually tell the story of, ‘can the people doing the work actually do their job’, and what’s the desired outcome?” he told the committee.
ACS CEO Dr Prins Ralston drew the comparison most people will immediately understand. A business owner can check a builder’s or electrician’s licence in a few minutes. There’s no equivalent for the person being trusted with customer data and business systems. “Small business owners can readily verify a builder’s or electrician’s licence,” she said. “Yet when choosing a provider to protect their systems and customers’ data, they often lack a clear, consistent way to assess capability.”
ACS is backing a fix for this called CyberPath, a Commonwealth-funded pilot that links professional standards to practical, verifiable evidence of competence. It’s a useful idea, but it isn’t available yet. The pilot opens to early adopters in February 2026, and the parliamentary committee examining all this isn’t due to report until March 2027. So for a business owner hiring a provider today, the more useful question is what you can actually check right now, and the answer already exists: the Australian Signals Directorate’s own Essential Eight framework, the free baseline it recommends every small business work toward.
What the Essential Eight actually covers
The Essential Eight is eight specific controls the ASD considers the minimum real protection against the kinds of attacks that actually hit small businesses: things like restricting which applications can run on your systems, keeping software patched, requiring multi-factor authentication, and making sure backups actually exist and actually work. The ASD doesn’t expect small businesses to implement all eight perfectly. It specifically recommends aiming for Maturity Level One, the entry tier of the framework, as a realistic starting point.
What makes this useful as a vetting tool is that it gives you a shared vocabulary with a provider before you’ve handed over any money. Before you even talk to anyone, it’s worth spending twenty minutes listing what your business actually can’t function without, customer records, payment systems, email, your point-of-sale, cloud storage, whatever applies. The ASD’s Small Business Cyber Security Guide is built around exactly this starting point, because a provider’s proposal is impossible to judge if you haven’t worked out what you’re actually protecting first.
From there, the conversation with a provider gets much sharper. Ask them to walk you through which of the Essential Eight controls matter most for your specific setup, not a generic package they sell everyone. If they can explain it in plain terms and tailor it to your business, that’s a good sign. If they’re vague or unfamiliar with the framework entirely, that’s worth noticing. Ask them what reaching Maturity Level One would concretely look like for your business and how long it would take. A specific answer gives you something to hold them to later; a vague one doesn’t.
It’s also worth asking how they prove a control is actually working, rather than just switched on. This is precisely the gap Zvěřina flagged in his testimony: a lot of compliance paperwork documents that something was configured, not whether it holds up under real conditions. The ASD’s Exercise in a Box tool is a free, self-paced simulated cyber incident exercise, and it’s a practical way to test whether your setup, or your provider’s work, actually functions when something goes wrong, rather than just existing on paper.
If your business uses AI tools as part of how it operates, it’s worth asking the provider directly where responsibility sits if something goes wrong with that part of the system, whether that’s with your business, with them, with the platform itself, or with whoever owns the data running through it. This is unsettled territory across the industry right now, so a provider who’s already thought it through is more trustworthy than one who hasn’t considered it at all.
And finally, before signing anything, it’s reasonable to run the proposal and pricing past someone who already has a relationship with your business, your accountant, your bank, an existing adviser. You don’t need a formal audit to get a sanity check from someone you already trust.
What’s coming, and what to use in the meantime
Zvěřina was careful to frame CyberPath as filling a gap rather than adding a burden. “We don’t want to make it harder,” he told the committee. “We don’t want to introduce new legislation or regulatory requirements.” The goal is a shared standard businesses and providers can both point to, something closer to the licence-check comparison Ralston drew.
Until that exists, the ASD’s existing framework, free at cyber.gov.au, along with the business.gov.au cybersecurity checklist, gives small business owners something to work from now, rather than waiting until 2027 to have a real basis for choosing who protects their business.
