Cyber security is no longer just an IT issue. It is a business risk that can damage a company’s reputation, disrupt operations, and erode customer and stakeholder confidence.

For directors and senior executives, the question is no longer, “is our IT team across this?” but rather, “can we demonstrate we’ve taken reasonable steps to manage cyber risk?”

September is an ideal time to answer that question. With year-end reporting, audits and EOFY activities behind us, businesses have an opportunity to step back, assess whether their cyber security controls remain fit for purpose and plan improvements before the busiest months of the financial year start again.

The risks are growing

Australian businesses face a steady stream of cyber threats. While attacks often begin with technology vulnerabilities or human error, the consequences are felt across the entire business through financial loss, operational disruption, reputational damage, regulatory scrutiny and reduced customer trust.

Small and medium-sized businesses are increasingly being targeted, often because cyber criminals perceive their defences to be less mature. According to the Australian Signals Directorate’s Cyber Threat Report 2024–25, the average self-reported cost of cybercrime has risen significantly, reaching $56,600 for small businesses, $97,200 for medium businesses and more than $202,000 for large organisations.

Cyber resilience has also become a governance issue. The Australian Securities and Investments Commission (ASIC) expects businesses to actively manage cyber risks, protect sensitive information and maintain governance arrangements that are appropriate for the size and complexity of the business.

Outsourcing IT does not outsource accountability. Directors and executives remain responsible for understanding cyber risks, ensuring appropriate controls are in place and obtaining assurance that those controls are operating effectively.

Questions every board should ask

Directors don’t need to understand every technical detail, but they should be confident management can answer some fundamental questions:

  • Do we know which systems and information are most critical to the business?
  • Have we implemented essential controls such as multi-factor authentication, software patching and secure backups?
  • Are employees receiving regular cyber security awareness and phishing training?
  • Do we regularly review who has access to systems and sensitive information?
  • Do we have a tested cyber incident response plan?
  • Are our third-party suppliers, including outsourced IT providers, introducing cyber risks, and how are we obtaining assurance over their controls?
  • Does our cyber insurance remain appropriate for our current risk profile?

If management cannot confidently answer these questions, further attention is likely required.

Actions to take this quarter

A cyber health check doesn’t need to be complicated.

Start by asking management for a plain-English assessment of the business’s cyber risk posture, including known control gaps, recent incidents and planned remediation activities.

Cyber security should also be a standing agenda item at board and executive meetings rather than something discussed only after an incident occurs. If your business hasn’t undertaken an independent cyber security review or maturity assessment recently, now is an ideal time to seek external assurance.

Finally, ensure your incident response plan has been tested. The first few hours of a cyber incident are often the most critical, and businesses that have rehearsed their response are generally better placed to minimise operational, financial and reputational impacts.

This article was co-written by Victor Babin from HLB Mann Judd Sydney.