Industry groups want simpler, usable guidance on cyber security for SMBs

In submissions to the inquiry into cyber security for small to medium sized businesses and organisations, industry groups recommended simpler and usable guidance, guidance on the use of AI, among other considerations.

The inquiry was launched in early July to report on the cyber security preparedness of these businesses following the creation of the House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations.

“This is the first federal inquiry to take a close look at the cyber security challenges facing small and medium-sized businesses,” Sally Sitou MP, chair of the committee, said in a statement at the time.

“We want to work directly with them to understand the threats they’re up against and how we can better protect them.”

The inquiry is looking into the cyber maturity on SMBs; the adequacy, appropriateness and accessibility of guidance provided to SMBs, if there are appropriate cyber security standards across SMBs; the ease for SMBs to procure appropriate cyber security services; the importance of training staff; the impact of cyber security maturity on the feasibility for SBS to participate in government and large corporate supply chains and other related matters.

“As we come to the end of the public hearing program, a clear message has emerged from witnesses: cyber security support should be actionable, targeted and accessible for small and medium sized businesses and organisations,” Sitou said on 28 October.

Submissions to the inquiry were accepted until early September and included submissions from the Chartered Accountants Australia and New Zealand, Commercial and Asset Finance Brokers Association of Australia, CPA Australia, Financial Advice Association on Australia and SMSF Association.

Simpler and usable guidance

The FAAA recommended in its submission that cyber security guidance for SMBs be consolidated in a single plain-language entry point, be reviewed regularly to reflect the current threat environment, be supported by practical case studies and include a proactive mechanism for alerting small business to emerging risks.

It recommended a system where education and support are the base rather than compliance and for an accreditation framework for managed security services providers. That government-supported training resources be modular and ongoing.

CPA Australia made some key recommendations including a tiered cyber security framework for small businesses aligned to the Essential Eight

CPA also recommended improvement of awareness and uptake of existing government guidance and free support programs by distributing them through trusted intermediaries; design cyber security training to reflect the operating constraints and varied levels of digital understanding across the small business sector.

The SMSF Association encourages the development of practical, proportionate and accessible cyber security guidance and standards that recognise the circumstances and resources of small businesses, while avoiding unnecessary duplication of existing regulatory and professional obligations.

Simple cyber maturity model, guidance that is simple and supported by checklists, case studies and decision tools are some of the recommendations from the Chartered Accountants Australia and New Zealand.

It pointed out that since the likely candidate to seek training and certification is the owner, not a dedicated IT professional, so such a program would need to be provided by government from training through to certification.

Commercial and Asset Finance Brokers Association of Australia recommended a dedicated Commonwealth funding for small business cyber security education be reinstated. An easy-to-understand, proportionate cyber security baseline, broaden and better publicise government cyber support services, promote cyber security awareness as a standard element of onboarding.

Finding the right cyber security services provider

The FAAA recommended that the government considers a way – be through a questionnaire, accreditation or any other form of evaluation – to help small businesses to assess what they need and can afford. It also recommended that the committee examine the terms that large product providers and platforms impose on small advice practices as a condition of market access.

CPA Australia recommended lower costs of cyber security services through targeted incentives

The SMSF Association highlighted some challenges that SMBs face. These include the cost and complexity of maintaining appropriate cyber security protections, dependence on third-party technology providers, limited bargaining power over contractual arrangements, access to affordable and appropriately skilled cyber security services, cyber insurance, legacy systems and data retention requirements.

The AI risk

CA ANZ brought up AI and that a cyber security policy needs practical guidance on AI as it is already being used, and in many cases, “without understanding how data is processed, stored, shared or exposed”.

The FAAA recommended practical guidance on managing cyber and operational risks associated with emerging AI technologies.

CAFBA recommended the delivery of targeted, practical guidance for SMBs on the safe and secure use of AI. And that cyber assurance requirements imposed through lender, aggregator and corporate panels are proportionate and tiered.

CPA Australia recommended the update small business cyber security guidance to address the safe use of AI tools.

Further recommendations

The FAAA recommended the identity authentication practices used by government agencies, superannuation funds, insurers and other institutions be examined when initiating unsolicited contact with small businesses.

CPA Australia cautioned the committee regarding the “comparatively low self-reported cyber risk, relative to other markets,” when assessing cyber maturity across small businesses.

The main point from SMSF is that small professional practices are not smaller versions of large corporations. “They often hold highly sensitive data and operate under significant regulatory obligations, yet they do so with fewer people, less bargaining power, less internal cyber expertise and substantial dependence on external technology providers,” it stated.

“The Association’s central recommendation is therefore that cyber policy for SMEs should focus on practical adoption and shared responsibility.”

Public hearings started on 6 October, and the last one took place on 4 November. The final report will be presented by 31 March 2027.

The committee also has an ongoing survey on the cyber security preparedness of small to medium sized businesses.