[Opinion] It’s time for government to mandate security standards for SMBs

In today's digital landscape, small and medium-sized businesses (SMBs) are increasingly targeted by cybercriminals, with the average cost of a cyberattack on Australian SMBs reaching nearly $50,000.

I attended a SMBiT Professionals Sydney Chapter meeting this week and it was obvious that despite this, many SMBs remain underprepared, often due to limited resources and awareness.

To address this, I think all levels of Australian government must take decisive action to promote engagement with standards-based IT security suppliers, thereby enhancing the cyber resilience of our business community.

They have done some things:

• Small Business Cyber Resilience Service: Launched as part of the 2023–2030 Australian Cyber Security Strategy, this initiative provides free, tailored, one-on-one support to help SMBs improve their cyber resilience and recover from cyber incidents.
• Small Business Cybersecurity Guides: The Australian Cyber Security Centre (ACSC) offers resources such as the Small Business Cyber Security Guide and Checklist, designed to help businesses implement basic security measures.
• Cybersecurity Health Check Programs: Voluntary programs have been established to allow businesses to assess and improve their cybersecurity postures, aiming to make SMBs less attractive targets for cybercriminals.

None of these fix the need for marketing and education and standardisation.

There is a pressing need for a unified, standards-based approach to IT security for SMBs.

Just as we have stringent standards for safety equipment like crash helmets and baby car seats, our businesses deserve robust cybersecurity standards to protect their operations and customer data.

I think government can help by:

1. Develop and mandate cybersecurity standards: Introduce clear, mandatory cybersecurity standards tailored for SMBs, similar to the Essential Eight framework recommended by the ACSC.
2. Incentivise compliance: Provide financial incentives, such as tax breaks or grants, to SMBs that engage with certified, standards-based IT security suppliers.
3. Enhance public awareness campaigns: Launch nationwide campaigns to educate SMBs on the importance of cybersecurity and the benefits of adhering to established standards.
4. Facilitate access to certified suppliers: Create a government-endorsed registry of IT security suppliers who meet the required standards, making it easier for SMBs to find trusted partners.

It's time for Australian governments at all levels to prioritise the cybersecurity of our SMBs by promoting engagement with standards-based IT security suppliers. By implementing clear standards, providing incentives, and raising awareness, we can build a more resilient and prosperous business landscape.

Otherwise our small businesses are trapped in an eternal game of cat and mouse, one we are all losing.

What do you think? Would love to see the comments!

Nick Beaugeard is the co-founder and CEO of Australian business process automation company World of Workflows.