Your laptop was stolen overnight. From a borrowed computer, get back into your business. The document that makes that possible is a run book.
Backups are the most-ticked, least-tested box in small business. ASD’s guidance says to test restores regularly - here’s why almost nobody does.
The CIA triad defines security as confidentiality, integrity and availability. The industry sells the first two and forgets the one that closes businesses.
Most cyber attacks are opportunistic, and attackers are on the clock. In June 2026 the median Australian small business scored an F on web security. Be the C.
ASD says the Essential Eight is designed for Windows-based networks. Most small businesses don’t have one - and 43% don’t enforce DMARC. What I suggest instead.
NIST’s 2025 guidelines dropped complexity rules: length beats symbols. A 2011 stick-figure comic was right all along - most password policies still aren’t.
In June 2026 the same 150 Australian small-business sites medianed A+ on technical SEO and F on security. The difference is what was on the launch checklist.
ASD is retiring the Essential Eight, quietly admitting it was built for a world we have left. A founder’s take: do not wait for the replacement - and do not assume it fits small business.
We scanned 450 domains Australians rely on. Enterprise and government medianed an F on web security - same grade as small business. Budget didn’t buy basics.
