Most Perth businesses assume they are reasonably secure. What we find when we actually look under the hood is usually a different story — MFA turned off on key accounts, backups that haven't been tested in a year, endpoint protection that expired six months ago and nobody noticed. This checklist exists to close that gap.
Run through these 8 items. If you can tick every one with confidence, your Perth business is in genuinely good shape. If you hit two or three you are unsure about, that is worth a conversation with us before something forces the issue.
The Australian Cyber Security Centre reports that over 94,000 cybercrime reports were filed in the 2023–24 financial year — one every six minutes. Perth SMBs represent a disproportionate share of victims because they hold valuable data and typically lack the internal IT resources to detect attacks early.
The 8-Point IT Security Checklist for Perth Businesses
Multi-Factor Authentication (MFA) on Every Account
Every user account — email, Microsoft 365, accounting software, remote access — requires MFA. Not just admin accounts. Not just some users. Every account. A stolen password without MFA is an open door. With MFA, the same stolen password is useless to an attacker. This single control blocks over 99% of account compromise attempts.
Keywords: MFA Perth business, multi-factor authentication Perth SMBAutomated Patch Management — Software Updated Within 14 Days
Unpatched software is the #1 way ransomware gets into Perth businesses. Every application — Windows, Office, browsers, line-of-business software — needs to be patched within two weeks of a security update being released. Manual patching doesn't happen consistently. Automated patch management does. This is the second Essential Eight control for a reason.
Keywords: patch management Perth, IT security compliance Perth WAEndpoint Detection and Response (EDR) on Every Device
Standard antivirus catches known threats. EDR watches for suspicious behaviour — something an attacker doing reconnaissance looks like even before they've deployed malware. Every device your staff uses (laptops, desktops, work mobiles) needs EDR. If your current endpoint protection hasn't been updated in the last 12 months or you don't know what's running on each device, that's a gap.
Keywords: EDR Perth, endpoint security Perth business, cybersecurity Perth small businessTested Backups — Stored Separately from Your Network
Ransomware targets your backups first. If your backup is on the same network as your data, it gets encrypted too. Your backup needs to be either offline (disconnected external drive rotated offsite) or cloud-based with immutable storage. More importantly — when did you last actually restore something from it? Untested backups fail when you need them most. Monthly restore tests are not optional.
Keywords: business backup Perth WA, disaster recovery Perth, backup testing Perth SMBEmail Filtering with Anti-Phishing Protection
Over 90% of cyberattacks on Perth businesses start with an email. Your email filtering needs to go beyond spam — it should detonate suspicious attachments in a sandbox before delivery, re-check links at click time, and flag emails impersonating your own domain. Microsoft 365 Defender with Safe Links and Safe Attachments enabled covers this well. If you're not sure whether yours is configured correctly, it's worth checking.
Keywords: email security Perth business, anti-phishing Perth, Microsoft 365 security PerthFirewall Configured and Actively Managed
A firewall that came with your router and hasn't been touched since installation is not a firewall — it's a false sense of security. A properly configured business firewall controls what traffic can enter and leave your network, blocks known malicious IPs, logs connection attempts, and gets reviewed when your business adds new systems or changes internet services. If yours hasn't been reviewed in the last 12 months, schedule that review.
Keywords: network security Perth, business firewall Perth WA, managed firewall PerthStaff Cybersecurity Awareness Training — At Least Annually
Technology controls have limits. A staff member who clicks a convincing phishing link or gives their password to someone on the phone bypasses every technical control you have. Annual security awareness training — covering phishing recognition, password hygiene, how to handle suspicious emails, and what to do if something looks wrong — is one of the highest-ROI security investments a Perth SMB can make. It doesn't need to be a full-day course; a focused 90-minute session works.
Keywords: cybersecurity training Perth, staff security awareness Perth WAPrivileged Access Management — Limit Admin Rights
If every staff member's computer runs as a local administrator, an attacker who compromises one account has admin access to that machine and potentially your entire network. Standard users should not have local admin rights. IT administrators should use a separate privileged account for admin tasks and their day-to-day email account for everything else. This is the simplest access control change you can make and one of the most effective.
Keywords: privileged access management Perth, IT access control Perth SMB, ASD Essential Eight Perth7–8: You're in solid shape. Book a free assessment with us to confirm the gaps and get a formal security posture report.
4–6: You have the basics but meaningful gaps remain — the unfixed ones are likely what an attacker would target first.
0–3: Your Perth business is carrying significant, addressable cybersecurity risk right now. Call us on (08) 9242 4511 today.
Frequently Asked Questions
What are the most important IT security controls for a Perth SMB?
MFA, automated patching, EDR on every device, tested off-network backups, and email filtering with anti-phishing — these five alone address the vast majority of the attack vectors used against Perth small businesses. The other three (firewall management, staff training, privileged access control) close the remaining gaps. Start with MFA if you haven't already — it takes an afternoon to implement and blocks the most common attack type immediately.
Is my Perth business required to meet the ASD Essential Eight?
Not legally if you are a private Perth SMB — but cyber insurers are increasingly requiring at least Maturity Level 1 compliance before issuing or renewing a policy. Beyond insurance, the Essential Eight is simply the most practical and well-evidenced cybersecurity framework available for Australian businesses. Implementing even the first four controls cuts your breach risk dramatically.
How do I get a cybersecurity assessment for my Perth business?
Call Managed ICT Solutions on (08) 9242 4511 or book online. We offer a free initial IT security assessment for Perth businesses — covering your current posture against the ASD Essential Eight, identifying your highest-risk gaps, and giving you a prioritised action plan with realistic cost estimates for remediation.
Not Sure How Your Perth Business Scores?
Book a free IT security assessment with Managed ICT Solutions. We'll run through this checklist with you, identify your real risk gaps, and give you a clear, prioritised plan — no jargon, no sales pitch. Just a straight answer about where you stand.
Book Free Security Assessment Call (08) 9242 4511