Small Business Cyber Security: When Your Accounts Team Runs IT

In many small businesses, the person who does the books also ends up looking after the technology. That makes small business cyber security an accounts job as much as an IT one. After all, the accounts team usually holds the logins to the bank, the accounting software, payroll and ATO online services.

October is Cyber Security Action Month, and this year’s theme on cyber.gov.au is “Take a second. Stay secure.” So, before the Christmas rush, here’s a practical plan for the person who keeps the money moving.

Why small business cyber security lands on the accounts desk

Think about who sets up new software subscriptions in your business. Next, think about who adds new staff to payroll and who approves supplier payments. In a small team, that’s often one person.

As a result, that person’s email and logins are some of the most valuable in the business. The Small Business Cyber Security Handbook from cyber.gov.au explains that criminals target small businesses because payment approvals and account changes often rely on trust and email. In other words, the accounts desk is exactly where they aim.

Three small business cyber security basics

The handbook suggests starting with three measures: multi-factor authentication (MFA), updates and backups. None of them needs an IT department.

1. Turn on multi-factor authentication

MFA asks for a second proof of identity when you log in. The handbook recommends starting with email, banking, cloud storage, accounting software and social media.

Also, some types of MFA are stronger than others. Codes sent by SMS or email are the least secure option, so use an authenticator app or a passkey where you can. Where MFA isn’t available, use a long, unique password of at least 15 characters. A password manager makes this much easier.

2. Keep software and devices up to date

Updates often fix security weaknesses. So, turn on automatic updates for computers, phones, apps and your browser. Then restart when prompted, rather than putting it off for weeks.

3. Back up, then test the restore

A backup only helps if you can get your data back. The handbook suggests a simple backup plan that answers what you back up, when, where it’s stored, who is responsible and how often you test it. Remember to include email and cloud data, not just the files on your computer.

Check who can act for your business with the ATO

Your ATO online services access is a big part of small business cyber security, so give it the same care as your bank. Each person who logs in should use their own myID. Never share yours, even with a trusted bookkeeper or family member.

The ATO suggests three simple checks to keep your business details secure:

• Review Relationship Authorisation Manager (RAM). RAM controls who can act for your business online.
• Review Access Manager. Access Manager controls what each person can do in ATO online services.
• Keep your ABN details current. Update your details on the Australian Business Register within 28 days of a change.

In addition, protect your myID itself. The myID website recommends using your device’s biometrics, turning on push notifications and regularly checking your devices and sign-in history. You can read more in protecting your Digital ID.

A small business cyber security checklist for staff changes

Staff changes are where access quietly builds up. For example, a Christmas casual might finish in January and still have a login to your point-of-sale system or shared drive.

When someone starts or leaves, work through this list:

• Give each person their own account, rather than sharing one login.
• Give people only the access they need for their role. Keep admin rights for the few who need them.
• Remove access promptly when someone leaves, including email, software, banking and ATO access.
• Change any shared passwords that the person knew.
• Reset devices before you dispose of them.

If you’re putting on extra staff for the busy season, our sister site BN Books has a guide to hiring Christmas casuals. For the wider employer picture, see our guide to payroll compliance.

Stop fake invoices and bank detail changes

Business email compromise is a scam where a criminal pretends to be a supplier, a customer or someone senior in your business. Typically, they ask you to pay an invoice into a “new” bank account.

The fix is simple, but it needs to be a firm rule. Whenever a request to change bank details or make an urgent payment arrives, check it by phone. Importantly, use a number you already have on file, not one from the email.

The weeks before Christmas are a good time to remind everyone of this rule. After all, people are busy, and urgent end-of-year payments feel normal. You can pair this with our holiday cash flow checklist.

Free small business cyber security help

You don’t have to work this out on your own. The government’s Small Business Cyber Resilience Service is free and delivered by IDCARE. It’s for businesses with 19 or fewer full-time equivalent employees, including sole traders. You can call 1800 595 170, Monday to Friday, 8am to 6pm AEST.

However, if you think you’re being attacked right now, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). You can also report cybercrime through ReportCyber at cyber.gov.au.

How Business Ninjas can help

We’re not an IT company. Still, as bookkeepers and a registered tax agent, we work with accounting software, payroll and ATO online services every day. That means we can help you tidy up who has access to your books and keep good records.

For bookkeeping, payroll and software set-up, visit BN Books. For tax returns and BAS, see BN Tax. Alternatively, take a look at our business services, call 1300 790 113, or contact us online. We’re 100% remote and work with businesses Australia-wide. We know small business!

This article is general information only and doesn’t take your circumstances into account. For help with a cyber incident, contact the Australian Cyber Security Hotline or a qualified IT professional.

Sources: cyber.gov.au: Small Business Cyber Security Handbook · ATO: Top cyber security tips for businesses and tax professionals · business.gov.au: Small Business Cyber Resilience Service