If you run a small or medium business in Australia, you will start hearing more about CyberSmart. It is a new government program to give smaller organisations a simple, recognised way to show they have their cyber security basics in place.
The scheme is not open yet, and a lot of the detail is still being worked out. That is actually good news. It means you have time to get the fundamentals sorted calmly, on your own terms, before anyone asks you to prove it.
This guide covers what has been announced, what hasn't, and the practical steps worth taking now.
What CyberSmart is
CyberSmart sits under Horizon 2 of the 2023–2030 Australian Cyber Security Strategy, which runs from 2026 to the end of 2028. The Horizon 2 program was announced by the Minister for Cyber Security, the Hon Tony Burke MP, on 11 June 2026.
In the Minister's media release, CyberSmart is described as offering "scalable, affordable support and certification tailored to business maturity, while strengthening supply chain security across the economy".
Home Affairs says the program will make cyber security certification "simple, affordable and accessible for small and medium sized businesses and not-for-profits", centred on a certification scheme based on a cyber security standard.
According to the Horizon 2 fact sheet for small and medium businesses, the program will:
- adopt a cyber security standard and accreditation scheme tailored to smaller businesses, covering "the cyber basics" first and then growing in maturity through a tiered approach
- create a CyberSmart Trust Mark to show an organisation has been certified
- establish a CyberSmart Hub as one place for program advice and support
- encourage uptake through government levers, including "risk-based application of CyberSmart in Commonwealth procurement and supply chain management"
What has been said so far, and what hasn't
Home Affairs ran a public CyberSmart town hall on 25 August 2026, and the transcript is published on the Horizon 2 page. A few points from it are worth knowing.
Said publicly so far:
- It is voluntary. Asked whether CyberSmart will be mandatory, the program director said: "No, CyberSmart is not going to be mandatory." He added that in certain high-risk environments, cyber assurance requirements could become mandated and CyberSmart could be integrated with those.
- It is a framework, not a brand-new standard. Officials said CyberSmart is intended to endorse and leverage existing industry standards for smaller entities, with the government able to create its own if no suitable standard exists.
- It will be tiered. The idea is that organisations start at an entry point suited to their size, operating environment and risk, rather than being held to requirements designed for large enterprises. Self-attested tiers are planned to keep costs down at the lower end.
- Accreditation goes through JASANZ. The scheme will be established under the Joint Accreditation System of Australia and New Zealand, with accredited bodies conducting certification.
- Procurement and supply chains are part of the picture. Over time, government procurement and critical infrastructure supply chain requirements "could also be used" to encourage smaller businesses to reach set maturity levels.
- Indicative timing. At the August 2026 town hall, officials said they were "looking to have a pilot of the program in the second-half of next year", likely around six months, followed by a national rollout "in the following year". They noted this could change as development progresses.
- The free Cyber Health Check stays. Home Affairs plans to keep offering free self-assessment through the Cyber Health Check tool and link it more closely to CyberSmart.
Not published yet (as at 2 November 2026):
- which standard or standards will be endorsed, and what each tier will require
- the cost of certification
- how long a certification lasts, or how often you will need to renew
- the design of the Trust Mark
- when and how applications will open
- exactly where and how CyberSmart will be used in procurement
Officials said directly that "the particulars of the standards, including associated costs and requirements and accreditation frameworks" are still under consideration. So treat anyone claiming to sell you "CyberSmart certification" today with healthy caution.
Why get the basics in order now
You don't need to wait for the final rules to make useful progress, for three reasons.
- The fact sheet says it will start with the basics. Whatever standards end up endorsed, the lower tiers are described as covering the cyber basics. Good habits now are unlikely to be wasted.
- Customers are already asking. Officials pointed out that organisations increasingly need to demonstrate their cyber maturity to customers, suppliers and government. Having your controls documented makes those questionnaires easier, with or without a trust mark.
- It is calmer to do it early. Sorting out logins, updates and backups on a sensible timeline is a lot less disruptive than doing it under a tender deadline or after an incident.
The most sensible reference point Australia already publishes is the Australian Signals Directorate's Essential Eight. One caution: officials described CyberSmart as a "step ladder" towards frameworks like the Essential Eight, not the same thing. So use the Essential Eight as a practical guide to good basics, not as a prediction of exactly what CyberSmart will test.
Practical prep, mapped to the Essential Eight
The Essential Eight is a set of eight mitigation strategies from ASD: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. Here is how a typical SME can approach them, starting with the four that tend to make the biggest everyday difference.
1. Multi-factor authentication
Turn on MFA for email, Microsoft 365 or Google Workspace, accounting software, banking, remote access and any admin accounts. Start with email and admin accounts, since those are the keys to everything else. Prefer an authenticator app or security key over SMS where your systems support it.
2. Patch applications and patch operating systems
Keep Windows, macOS, servers, browsers, Office, PDF readers and your line-of-business apps up to date. Switch on automatic updates where you can, and keep a short list of anything that can't be updated automatically so someone owns it. If you are running software or servers that no longer get security updates, plan the replacement now. (Our Windows Server 2016 end of support plan shows what that looks like in practice.) Websites count too, as our posts on WordPress and PHP vulnerabilities explain.
3. Regular backups
Back up the data you can't run without: files, accounting data, customer records, and cloud services like Microsoft 365. Keep at least one copy that ransomware can't reach or change, and, most importantly, practise a restore. A backup you have never tested is a hope, not a plan.
4. Restrict administrative privileges
Day-to-day accounts should not be admin accounts. Give admin access only to the people who need it, use separate admin logins for admin work, and remove access promptly when staff leave or change roles. This one step limits how far a single compromised login can go.
The other three, briefly
- Application control: only allow approved software to run on business devices.
- Restrict Microsoft Office macros: block macros unless your business genuinely needs them, and then only from trusted sources.
- User application hardening: tighten browser and app settings, for example removing unneeded plugins and features.
These are more technical, and it is fine to tackle them after the basics above. ASD's Essential Eight maturity model explains how to build them up in stages.
A simple owner checklist
- MFA is on for email, finance and all admin accounts
- Automatic updates are on for computers, phones and key apps
- We know what software or servers are out of support, and have a plan
- Backups include cloud data, one copy is offline or immutable, and we tested a restore this quarter
- Only the people who need admin access have it, and leavers are removed on their last day
- Someone in the business owns cyber security, even if an IT partner does the work
- We have run the free Cyber Health Check to see where we stand (Home Affairs says this free self-assessment stays)
- We know where to report an incident: cyber.gov.au or 1300 CYBER1 (1300 292 371)
Write down what you have done and when. If CyberSmart, a customer or an insurer asks later, you will have the answers ready.
What OrionX would build
The checklist above is the easy part to write and the hard part to keep true. MFA gets switched off for one "temporary" account, a laptop stops updating, a backup job quietly fails, a leaver keeps admin rights. So rather than a one-off audit, here's what we'd actually build for a typical SME running Microsoft 365 or Google Workspace:
- A cyber basics evidence collector. A small scheduled job that pulls posture data straight from your systems' admin APIs (for Microsoft 365, Microsoft Graph and Intune: who has MFA registered, who holds admin roles, which devices are out of date or unmanaged, which sign-ins skip MFA). It writes a dated snapshot every week, so "we did it" becomes a record, not a memory.
- One basics dashboard, mapped to the Essential Eight. Each control shows green, amber or red with the actual accounts or devices causing it, not a vague score. Owners see the list of things to fix this week.
- Drift alerts. A new global admin, a user with MFA removed, a device that hasn't patched in 30 days, a backup job that hasn't succeeded since Tuesday. Each one raises an alert to a named person, not a shared inbox nobody reads.
- Joiner and leaver automation. Starting and leaving staff go through one form that grants or removes accounts, admin rights and app access in the right order, with a log of what changed and when.
- Automated restore tests. A scheduled restore of a sample of files, mailboxes and your accounting data into an isolated space, with a pass/fail report. That's the evidence a "regular backups" control actually needs.
- An evidence pack on demand. When a customer questionnaire, an insurer or (once it opens) CyberSmart asks, you export the history: dates, controls, exceptions and what was done about them.
None of this needs a big security platform. It's mostly scheduled scripts, a small database and a dashboard sitting on the tools you already pay for.
Need a hand getting the basics sorted?
Many of the businesses we work with have grown faster than their IT setup. Logins, updates and backups were set up years ago and nobody has had time to revisit them. That is completely normal, and usually very fixable.
Start with a free 20–30 minute chat about where your cyber basics stand and what CyberSmart might mean for you. If it's a good fit, we'll follow up with one free demo tailored to your setup (one per business). No pressure, just a clear picture of what to do next.
If your systems live in the cloud, our cloud solutions page covers how we help keep them secure and well managed.
Sources
- Department of Home Affairs, Horizon 2: Expanding our reach (2026–2028), including the CyberSmart program public town hall transcript (25 August 2026). Accessed 2 November 2026.
- Department of Home Affairs, Horizon 2 fact sheet: small and medium businesses.
- The Hon Tony Burke MP, Securing our future: Horizon 2 of the Australian Cyber Security Strategy, media release.
- Australian Signals Directorate, Essential Eight explained.
- Australian Signals Directorate, Essential Eight.
