Secure important accounts
Use individual accounts, strong unique passwords and multifactor authentication where supported. Prioritise email, cloud administration, source code and payment systems. Grant access according to responsibilities and remove it promptly when no longer needed. Keep recovery arrangements secure and accessible to authorised people.
Know where information lives
Maintain a simple inventory of devices, services and important data. Limit unnecessary collection and sharing. Review access to customer information and sensitive business material. When adopting a new tool, understand its purpose, administrator and data handling before adding it to the workflow.
Maintain and recover systems
Apply security updates promptly using a process suited to the system. Back up important information and configurations, and test restoration. Consider how access to backups is protected from a compromised main account. Agree how much data loss and downtime the business can tolerate.
Prepare an incident response
Record who coordinates an incident, how to contact key providers and where critical recovery instructions are held. Practise a scenario such as loss of access to company email. Legal or contractual notification requirements depend on the facts and jurisdiction; obtain advice when an incident arises. The Australian Cyber Security Centre publishes practical small-business guidance.
Your next steps
- Inventory important systems and data.
- Enable MFA and review account access.
- Assign responsibility for updates.
- Test backup restoration.
- Record incident contacts and recovery steps.