Start with the three basics
The ACSC recommends three starting measures for a small business: turn on multi-factor authentication, update your software and back up your information. After that it recommends Maturity Level One of the Essential Eight.
If you do nothing else this quarter, do these three on every device and account the practice uses.
Remember
- Multi-factor authentication.
- Updates.
- Backups.
Facts and sources for this part
- The ACSC recommends three starting measures for a small business: turn on multi-factor authentication, update your software and back up your information. After that it recommends Maturity Level One of the Essential Eight. [S32]
Accounts: MFA and passphrases
Multi-factor authentication puts an extra layer of security on accounts, making it harder for others to gain access. Apply it to all devices used for your business.
A passphrase can be a set of 4 or more random words. A password manager can help you generate and store passphrases.
Remember
- MFA on email, practice software, banking and cloud storage first.
- Passphrases from a password manager, not reused.
Facts and sources for this part
Access: myID, RAM and who can see what
Each person acting for a practice needs their own Digital ID such as myID and must be authorised in RAM. Staff cannot share a myID or a device, and you should never let anyone enter your log in code for you.
Access by past employees is a common cause of identity security or fraud issues. Remove system access for people who no longer work for you, and set a reminder for a regular check-up in both RAM and Access Manager.
Remember
- One person, one myID, one device.
- Leavers: remove access the same day.
- Diary a regular RAM and Access Manager check-up.
Facts and sources for this part
- Each person acting for a practice needs their own Digital ID such as myID and must be authorised in RAM. Staff cannot share a myID or a device. [S26]
- Never let anyone else use your myID or enter your log in code for them. Your principal authority can track your access to Online services for agents. [S26]
- Access by past employees is a common cause of identity security or fraud issues. Remove system access for people who no longer work for you, and review access when roles change. [S12]
- If your practice uses ATO online services, set a reminder to do a regular check-up in both Relationship Authorisation Manager (RAM) and Access Manager. [S12]
Devices, updates, backups and paper
Apply updates as soon as possible and turn on automatic updates. Upgrade software that no longer receives updates.
Keep backup devices off your main network when not in use, avoid public wireless networks for work, and make sure client and staff data is securely stored at the end of each day. A laptop left in a car is a breach waiting to happen.
Remember
- Automatic updates on.
- Offline backup that ransomware cannot reach.
- Lock away paper and laptops at close of business.
Facts and sources for this part
- Apply updates as soon as possible and turn on automatic updates. Upgrade software that no longer receives updates. [S12]
- Back up regularly. Keep backup devices secure by making sure they are not continuously connected to your main network. [S12]
- Avoid using public wireless networks for work tasks, and use a strong password on your business wi-fi. [S12]
- Make sure client and staff data is securely stored at the end of each day. [S11]
Suppliers and cloud software
When choosing software, ask the vendor whether your data is stored in Australia or overseas and what data breach support they give. Cloud and outsourced providers are third parties under Code item 6, so your clients should be told about them.
Keep a list of every supplier that holds client data and who at the practice owns each relationship.
Remember
- Where is the data? What support after a breach?
- A supplier list with an owner for each.
Facts and sources for this part
- When choosing software, ask the vendor whether your data is stored in Australia or overseas, what data breach support they give, and whether they follow the Essential Eight. [S12]
- A third party includes entities you outsource work to and cloud storage providers. Outsourcing and cloud storage do not change your duty under Code item 6 to keep client information confidential. [S6]
Staff, and the one-page plan
Staff education is critical: do not click links, open attachments or download files from a suspected phishing email. The ACSC small business guide includes a section on preparing staff, with employee education and an emergency plan.
Put the controls from this lesson on one page with a named owner and a review date. The Code requires a system of quality management that covers confidentiality, so a written plan is also your evidence.
Remember
- One page, one owner, one review date.
- Include who to phone first after an incident.
Facts and sources for this part
- Staff education is critical: do not click links, open attachments or download files from a suspected phishing email. [S11]
- The ACSC small business guide includes a section on preparing staff, with employee education and an emergency plan. [S32]
- Under section 40 of the 2024 Code determination you must keep a system of quality management, covering policies and procedures for areas that include proper record keeping and protecting confidentiality of information. [S25]
Scenario: the departing bookkeeper
A bookkeeper leaves on bad terms on a Friday afternoon. Their myID is linked to the practice and their email still works.
Before they leave the building, the principal removes their authorisation in RAM and their permissions in Access Manager, closes their email and changes shared passphrases. The same day, the principal looks for lodgments they should not have made.
Remember
- Remove access before the person leaves.
- Check for unexpected activity afterwards.
Facts and sources for this part
- Access by past employees is a common cause of identity security or fraud issues. Remove system access for people who no longer work for you, and review access when roles change. [S12]
- If your practice uses ATO online services, set a reminder to do a regular check-up in both Relationship Authorisation Manager (RAM) and Access Manager. [S12]
- Signs of a breach include lodgments on client accounts you did not make, changes to client files you did not make, being unable to log in or finding account verification emails deleted, and devices running abnormally. [S11]
Scenario: ransomware on a Friday
On Friday a screen appears saying all files are locked and demanding payment. The backup drive was left plugged in.
A drive that is always connected can be locked too, so recovery depends on an offline backup. Do not pay without advice, because the fraudsters may unlock your systems but you could be targeted again. Phone the ATO and treat it as a breach.
Remember
- An offline backup is the way out.
- Paying does not end the risk.
Facts and sources for this part
- Back up regularly. Keep backup devices secure by making sure they are not continuously connected to your main network. [S12]
- In another ATO case, an agent clicked a link in an authentic looking email and a crypto virus locked their systems. If you pay a ransom the fraudsters may unlock your systems, but you could be targeted again. [S11]
Checklist: the one-page plan
Multi-factor authentication on email, practice software and banking. Automatic updates. An offline backup. One myID per person, with leavers removed the same day. A supplier list with where data is stored. Disposal of equipment. Staff training. The first three phone numbers for an incident.
Give each line a name and a date. A plan nobody owns is a plan nobody follows.
Remember
- Eight lines, each with an owner.
- Review it on a set date.
Facts and sources for this part
- The ACSC recommends three starting measures for a small business: turn on multi-factor authentication, update your software and back up your information. After that it recommends Maturity Level One of the Essential Eight. [S32]
- Access by past employees is a common cause of identity security or fraud issues. Remove system access for people who no longer work for you, and review access when roles change. [S12]
- When choosing software, ask the vendor whether your data is stored in Australia or overseas, what data breach support they give, and whether they follow the Essential Eight. [S12]
- You need arrangements to prevent inadvertent disclosure of client information, including when you dispose of IT equipment and when IT consultants or cleaners are in your office. [S6]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
Why should backup drives not stay plugged in all the time?
Show the answer
Right answer: D, Ransomware could reach and encrypt them, so keep them off the main network. The ATO advises keeping backup devices secure by not continuously connecting them to your main network. [S12]
Question 2 of 3
What is a passphrase?
Show the answer
Right answer: D, A set of 4 or more random words. The ATO describes a passphrase as a set of 4 or more random words, numbers and symbols, which a password manager can store. [S12]
Question 3 of 3
Why write the practice's security plan down?
Show the answer
Right answer: B, The Code requires a quality management system covering confidentiality, and a plan is evidence of it. The 2024 determination requires a system of quality management that includes protecting confidentiality, and a written plan shows it. [S25]