1 Support small and medium businesses to strengthen their cyber security The problem we face Small and medium businesses play a vital role in our economy, contributing more than $500 billion3 to annual gross domestic product and employing around 43% of the private sector labour market.4 But Australian small businesses consistently express concern over their lack of time, resources and expertise to uplift their cyber security. They struggle to attract and retain skilled cyber professionals, procure the right services or know where to invest in uplifting their cyber resilience. As a consequence, small and medium businesses can take longer to recover from a cyber incident and face higher costs compared to larger businesses. For large organisations, incidents affecting a small or medium business in their supply chain can cause significant damage. An incident in a large organisation’s supply chain can cause major downstream impacts, disrupting service delivery. Or, where a small business is integrated into the networks of a large organisation, a cyber attack on the smaller entity can unlock a ‘back door’ into the larger organisation that malicious actors can easily exploit. How the Government will take action The Australian Government recognises that uplifting cyber maturity can be challenging for small and medium businesses, particularly when balancing competing priorities. Without appropriate support and guidance, investment in cyber security can seem overwhelming. Under this initiative, the Government will: 1. Offer advice and guidance to support small and medium businesses The Government will create a cyber health-check program that will offer a free, tailored assessment of cyber security maturity to small and medium businesses. Based on international exemplars, the health-check program will provide educational tools and materials to help small and medium businesses improve their cyber security posture. The health check program will support the delivery of the existing Cyber Wardens Program for small businesses, which allows them to better understand cyber security risks and build in house capability to manage cyber threats. As cyber security requirements for small and medium businesses evolve, the Government will continue to adapt its guidance for business leaders. The Government will ensure that small business support programs are easy to understand and accessible, and that businesses have strong incentives to participate. Wherever possible, the Government will limit regulatory burden on small businesses and help them to do what they do best: focus on their businesses and the goods and services they provide. 3. Australian Small Business and Family Enterprise Ombudsman (2023). Small Business Matters. 4. Reserve Bank of Australia (2023). Recent Developments in Small Business Finance and Economic Conditions. 18 2023–2030 Australian Cyber Security Strategy