Free government cyber checks for small business, and what they don't cover
The Australian Government wants small businesses to check their cyber security, and it offers several free ways to start. They're genuinely useful, and we'd suggest anyone begin with them. Here's what each one is, who can use it, and where you might need someone to look at your actual systems.
Last updated
The short answer
Australian small businesses can use the free Cyber Health Check tool on cyber.gov.au, a self-assessment that takes under five minutes and is anonymous. Businesses with 19 or fewer full-time equivalent employees can get free one-on-one help and a plan from IDCARE's Small Business Cyber Resilience Service. The Australian Signals Directorate also publishes free guides, including one on securing a website. These are self-assessments and advice; none of them logs in to your systems or fixes anything for you.
Is a cyber check required?
No. These checks are voluntary. In its Horizon 2 plan for 2026 to 2028, the government says it will develop a cyber security standard and certification for small and medium businesses, called CyberSmart, with a trust mark certified businesses can display, and will use government buying to encourage it. It is still being designed. For now there is no law that makes a small business check its cyber security or its website.
What's on offer
Cyber Health Check tool
A free online self-assessment from the government at cyber.gov.au. It's for individuals, small businesses and not-for-profits, takes less than five minutes and is anonymous. It gives you a list of steps to take next.
Small Business Cyber Resilience Service
Free, person-to-person help from IDCARE for businesses with 19 or fewer full-time equivalent employees, including sole traders. They work out a plan with you and help you recover if something goes wrong. Call 1800 595 170, Monday to Friday.
ASD small business guides
The Australian Signals Directorate's small business hub and handbook cover accounts and sign-ins, devices, backups, customer data and staff training, in plain language.
Secure your website
A free ASD guide to the website basics: multi-factor sign-in on the admin, HTTPS, updates and plugins, backups, domain renewal and questions to ask your host.
Exercise in a Box
A free ASD tool for running a practice cyber incident with your team, so you find the gaps before a real one.
Digital Solutions advice
A government-funded program for businesses with fewer than 20 employees. Workshops and webinars are free, and up to five hours of one-on-one advice, which can cover cyber security and privacy, costs a small fee.
Who should use them
- Every small business that hasn't looked at its cyber security before. Start with the five-minute Cyber Health Check.
- Businesses with 19 or fewer staff that want a person to talk it through, through IDCARE.
- Owners who look after their own website and want a checklist, through the ASD's website guide.
- Anyone who has just had a scam or a hacked account. Report it at cyber.gov.au or call 1300 CYBER1 (1300 292 371).
Where the free checks stop
- They rely on your answers. A self-assessment tells you what you believe is set up. It can't see that the backup stopped running in March or that an old staff account still has admin rights.
- Nobody looks at your actual systems. None of the free services logs in to your email, website, hosting or domain to check the settings.
- They don't do the fixes. You get a plan. Turning on multi-factor sign-in, fixing email records or updating plugins is still up to you or your IT provider.
- The website is only part of it. Most free checks are about the office: passwords, devices and backups. Few look at what your website collects, which tracking tags it runs or whether your privacy policy matches.
Where WaTo picks up
- Do the free Cyber Health Check first. Then our cyber security health check looks at your actual settings, from $690 ex GST.
- For the website, our website security and compliance audit checks security, the domain, email protection, forms, tracking tags and the privacy policy, from $290 ex GST.
- We can do the fixes the free checks point to, or hand you a plan for whoever looks after your IT.
Free cyber check questions
Is the government Cyber Health Check really free?
Yes. The Cyber Health Check tool on cyber.gov.au is free and anonymous, and IDCARE's Small Business Cyber Resilience Service is free for businesses with 19 or fewer full-time equivalent employees.
Does the government require small businesses to do a cyber check?
No. It is recommended, not required. The government plans a small business cyber standard and certification called CyberSmart, with a trust mark, as part of its 2026 to 2028 cyber security plan, but there is no legal requirement today.
Will the free check look at my website?
Not in detail. The Cyber Health Check asks general questions about your business. The ASD's website guide is a good checklist, but you'd need to work through it yourself or with your web provider.
Who do I call if I've been hacked?
Report it at cyber.gov.au or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). Small businesses can also call IDCARE on 1800 595 170. If customer information may have been taken and the Privacy Act covers you, you may need to tell the OAIC.
How WaTo can help with this
Guides on this topic
- Do I actually need cyber security?
- How much does an IT health check cost?
- Is my website safe?
- Website compliance checklist for Australian small businesses
Sources & references
- Australian Signals Directorate: Cyber Health Check tool
- business.gov.au: Small Business Cyber Resilience Service
- Australian Signals Directorate: Small business hub
- Australian Signals Directorate: Secure your website
- Australian Signals Directorate: Exercise in a Box
- business.gov.au: Digital Solutions, Australian Small Business Advisory Services
- Home Affairs: 2023-2030 Australian Cyber Security Strategy, Horizon 2 Action Plan
WaTo Consulting. Last reviewed 2026-11-07. Review every six months, and when IDCARE's funding changes after June 2027.
Done the free check and want the next step?
Tell us what it flagged and we'll quote the fixes, or book a fixed-price check of your actual systems and website.
Mon to Fri, 8:30am to 5pm
