You are not sure where to start
Get a simple risk level and a short list of fixes instead of trying to read a full framework first.
Free cyber safety tool
Small Business Cyber Safety Self Check
In five minutes, check the cyber basics that matter most to small businesses: email logins, backups, updates, staff access, risky files, and device safety.
Get a plain-English action plan and choose whether you want local help to fix the gaps. This is a practical self-check and preparation guide, not a formal government certification or audit.
When to use this check
Use this if you own or manage a small business and want to know what cyber basics need attention first.
You need to protect key accounts
Check whether email, cloud, accounting, banking and website admin accounts have basic login protection.
You need supplier or insurance answers
Find out which cyber evidence areas may need a closer review before answering business questions.
Answer the quick questions
Tick the statements that are true for your business. The result updates automatically.
How this relates to the Essential Eight
Based on public ASD/ACSC Essential Eight guidance. This page uses small-business language first, then maps back to the technical areas.
- Two-step login
multi-factor authentication. - Software updates
patching applications and operating systems. - Admin access
restricting administrative privileges. - Safe backups
regular backups and recovery. - Risky Office files
Microsoft Office macro controls. - Safer browsers and apps
user application hardening and application control.
This self-check helps small businesses improve Essential Eight alignment step by step.
What this means for a small business
The goal is not to make you a cyber expert. The goal is to help you protect the things that keep your business running.
Money
Email and accounting account protection helps reduce fake invoice and payment redirection risk.
Files
Safe backups help you recover if files are locked, deleted or damaged.
Staff devices
Updates and reduced admin access can limit damage if someone clicks the wrong thing.
What to fix first
If your result shows gaps, do not try to fix everything at once. Start with the few items that reduce the biggest everyday risk.
1. Protect email and key accounts
Turn on two-step login for email, cloud, accounting, banking, website admin and social media accounts.
2. Check backups and recovery
Make sure important files are backed up, recovery has been tested and ransomware cannot easily reach every backup copy.
3. Review updates and admin access
Keep computers and apps updated, remove old access, and avoid using admin accounts for daily work.
Related tools
Use the hub and related tools to check the other parts of your small business cyber safety setup.
Cyber Safety Hub
Return to the hub and choose your business concern.
Small Business Cyber Safety Self Check
Start with the full five-minute check across logins, backups, updates, access and device safety.
Email & Login Safety Checker
Check two-step login and account access for email, cloud, accounting, website and social platforms.
Backup Safety Checker
Check whether files, invoices, records and job photos can be recovered if something goes wrong.
Staff Access Risk Checker
Review old accounts, admin access, shared passwords and contractor access.
Out-of-Date Computer Risk Checker
Check whether computers, browsers, Office, accounting apps, POS systems and remote access tools are being kept up to date.
Risky Office Attachment Checker
Check whether risky Office files, invoices, spreadsheets, supplier documents or attachments could put your business at risk.
Safer Browser & App Settings Checker
Check browser updates, extensions, downloads, password saving, PDF readers, remote access apps and common unsafe app settings.
Cyber Insurance & Tender Evidence Helper
Prepare a plain-English evidence checklist for insurers, suppliers, clients or tenders.
Small Business Cyber Action Plan Builder
Turn your answers into a simple action plan: first 3 fixes, this week, this month and later.
Need help turning this into real protection?
Your IT & Tech Mates can help set up two-step login, backups, updates, admin access, safer devices, and a plain-English cyber action plan for your business.
FAQ
Is this private?
The tool runs in your browser and does not ask for passwords, login codes, card numbers or sensitive customer details.
Is this a formal assessment?
No. Based on public ASD/ACSC Essential Eight guidance, this is a practical self-check and preparation guide, not a formal government certification or audit.
What if I get a high-risk result?
Do not panic. Start with the top three fixes and get local help if the risk involves email, money, backups, staff access or customer records.