You use Microsoft 365, Google Workspace, Xero, MYOB, banking portals, WordPress, Shopify or social media for business
You use Microsoft 365, Google Workspace, Xero, MYOB, banking portals, WordPress, Shopify or social media for business.
Small business cyber safety
Email & Login Safety Checker
Could someone get into your business accounts?
Check whether important business accounts like Microsoft 365, Google, Xero, banking, website admin and social media have extra login protection. Based on public ASD/ACSC Essential Eight guidance.
Email safetyTwo-step loginOld access cleanupPractical self-check
When to use this check
Use this when you want a practical business-owner answer, not a technical framework first.
You are not sure whether every important account has two-step login turned on
You are not sure whether every important account has two-step login turned on.
Staff, old staff or contractors may still share passwords or have access they no longer need
Staff, old staff or contractors may still share passwords or have access they no longer need.
Privacy: this checker runs in your browser and does not ask for sensitive details.
Answer the quick questions
Tick the statements that are true or risky for your business accounts.
How this relates to the Essential Eight
This check relates mainly to two-step login, admin access, and safer account management. In Essential Eight language, it supports multi-factor authentication and restricting administrative privileges.
Helps improve Essential Eight alignment step by step. This is a practical self-check, not a formal government certification or audit.
What this means for a small business
Email, accounting, banking and website admin accounts are usually high priority because they can affect money, invoices, customer trust and daily operations.
What to fix first
- Turn on two-step login for business email and admin accounts.
- Protect accounting, banking, website and social media admin access.
- Remove old staff, contractor and shared account access.
Why it matters
These basic checks help protect business money, files, customer records, staff devices and daily operations.
When to get local help
Need help setting up two-step login safely without locking staff out? Your IT & Tech Mates can help review and protect your key accounts.
Related tools
Use the hub and related tools to check the other parts of your small business cyber safety setup.
Cyber Safety Hub
Return to the hub and choose your business concern.
Small Business Cyber Safety Self Check
Start with the full five-minute check across logins, backups, updates, access and device safety.
Email & Login Safety Checker
Check two-step login and account access for email, cloud, accounting, website and social platforms.
Backup Safety Checker
Check whether files, invoices, records and job photos can be recovered if something goes wrong.
Staff Access Risk Checker
Review old accounts, admin access, shared passwords and contractor access.
Out-of-Date Computer Risk Checker
Check whether computers, browsers, Office, accounting apps, POS systems and remote access tools are being kept up to date.
Risky Office Attachment Checker
Check whether risky Office files, invoices, spreadsheets, supplier documents or attachments could put your business at risk.
Safer Browser & App Settings Checker
Check browser updates, extensions, downloads, password saving, PDF readers, remote access apps and common unsafe app settings.
Cyber Insurance & Tender Evidence Helper
Prepare a plain-English evidence checklist for insurers, suppliers, clients or tenders.
Small Business Cyber Action Plan Builder
Turn your answers into a simple action plan: first 3 fixes, this week, this month and later.
Need help turning this into real protection?
Your IT & Tech Mates can help set up two-step login, backups, updates, admin access, safer devices, and a plain-English cyber action plan for your business.
FAQ
Which accounts should I protect first?
Start with business email, Microsoft 365 or Google Workspace admin accounts, accounting, banking, website admin and social media business accounts.
Will two-step login lock staff out?
It can cause problems if rolled out badly. Plan staff communication, recovery options and admin backup access before turning it on everywhere.
Is this a formal audit?
No. This is a practical self-check based on public ASD/ACSC Essential Eight guidance, not a formal government certification or audit.