Failures, incidents and official sources
Official cyber security sources and free help for Australian businesses
Where Australian businesses find official cyber guidance, report incidents and get free help: ASD's ACSC, OAIC, Home Affairs, IDCARE, business.gov.au, Scamwatch and dispute bodies.
The main official sources for an Australian business buying or running managed cyber security are ASD's Australian Cyber Security Centre (cyber.gov.au) for technical guidance, the Essential Eight, incident reporting and the 24/7 hotline 1300 CYBER1; the OAIC (oaic.gov.au) for the Privacy Act and data breach notification; the Department of Home Affairs for the Cyber Security Act 2024; business.gov.au for small business checklists and referrals; and IDCARE's Small Business Cyber Resilience Service for free one-on-one help for businesses with 19 or fewer employees. For disputes with providers or insurers, the small business ombudsman and AFCA can help. This guide lists what each body does and when to use it.
This guide belongs to the failures pillar. Programs and contact details change; check each site for the current version.
In an incident: who to contact
| Need | Contact | Notes |
|---|---|---|
| Urgent cyber incident advice | Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371) | 24/7, run by ASD's ACSC |
| Report a cybercrime or incident | ReportCyber at cyber.gov.au | Reports are referred to police where appropriate |
| Free recovery help for small business (19 or fewer employees) | IDCARE Small Business Cyber Resilience Service, 1800 595 170 | Free; Monday to Friday business hours; also offers case management and referrals |
| Identity misuse after a breach | IDCARE | Free support for individuals |
| Data breach notification | OAIC Notifiable Data Breach form | If the Privacy Act applies and the breach is eligible |
| Ransomware payment report | Through cyber.gov.au | If turnover above $3 million or SOCI responsible entity; within 72 hours |
| Life in danger | 000 | Only for immediate danger |
Guidance and prevention
ASD's Australian Cyber Security Centre (cyber.gov.au)
- Essential Eight strategies and maturity model, and since October 2026 the broader ASD Essentials series that evolves it; check the current version before scoping work. See Essential Eight uplift.
- Small business resources, including step-by-step guides on backups, updates and MFA.
- Cyber Health Check, a free, anonymous self-assessment that produces an action plan.
- Alerts and advisories on current threats.
- ASD's Cyber Security Partnership Program: according to cyber.gov.au, an Australian business with an ABN can register as an ASD Business Partner to receive threat updates, a newsletter, the alert service and event invitations, while organisations responsible for securing networks (their own or customers') and some security vendors may be eligible for the fuller partner tier. Tiers and eligibility change, so check the current page before applying. It is information sharing, not a managed service.
business.gov.au
- A cyber security checklist, guidance on writing a cyber security policy and protecting customer information.
- Referral to the Small Business Cyber Resilience Service and to Digital Solutions advisers for help adopting digital tools.
- General business contact centre on 13 28 46.
Government-funded programs (check status before relying on them)
- The Cyber Security Business Connect and Protect Program is a Commonwealth grant program, established by a 2020 instrument, that has funded trusted organisations such as industry associations to deliver cyber security advice to small businesses. Its grant round has closed, and in October 2026 business.gov.au no longer listed an open round; check business.gov.au for any current program before relying on it.
- Industry-led programs such as cyber awareness training for small business staff have received government funding in recent years. Check the program's own site and business.gov.au for current availability.
Law and regulators
| Body | Role | Use it for |
|---|---|---|
| OAIC | Privacy regulator | Whether the Privacy Act applies, APP 11, NDB scheme, small business guidance |
| Department of Home Affairs | Policy owner for the Cyber Security Act 2024 | Ransomware payment reporting guidance, compliance approach |
| Cyber and Infrastructure Security Centre | SOCI Act regulator | Whether you are a responsible entity, SOCI incident reporting |
| Federal Register of Legislation | Official text of laws | Privacy Act 1988, Cyber Security Act 2024 and Rules, SOCI Act, Criminal Code |
| ACCC | Competition and consumer regulator | Unfair contract terms in small business contracts |
| ATO | Tax | GST on services and imported digital services, input tax credits |
The Cyber Security Act 2024 also set up a Cyber Incident Review Board to conduct no-fault reviews of significant incidents; its chair and members were appointed in 2026. Its reviews may be useful reading for lessons learned.
Scams and fraud
- Scamwatch, run by the ACCC's National Anti-Scam Centre: report scams, including business email compromise and invoice fraud.
- Your bank: call immediately if a payment went to a fraudster's account; speed matters.
Disputes and complaints
| Dispute | Where to go |
|---|---|
| Contract dispute with a managed security provider | Provider's complaints process, then the Australian Small Business and Family Enterprise Ombudsman or your state small business commissioner |
| Insurance claim dispute | Insurer's internal process, then the Australian Financial Complaints Authority |
| Privacy complaint about how another organisation handled your data | The organisation first, then the OAIC |
| Unfair contract terms concern | ACCC (report), legal advice |
How to use official sources when buying
- Use the ACSC's Essential Eight and small business guides to write your scope brief.
- Use the OAIC's guidance to check whether the Privacy Act applies and what that means for logs and data location.
- Use Home Affairs and the Act text to decide whether ransomware payment reporting applies to you.
- Ask providers to map their service to these sources, then check the mapping yourself.
Frequently asked questions
Is the ACSC hotline free?
Yes. It is a government service available 24 hours a day.
Can the ACSC recommend a provider?
The ACSC publishes guidance on choosing and managing providers but does not rank them. Use the selection method.
Who is eligible for IDCARE's small business service?
According to business.gov.au, small businesses with 19 or fewer full-time equivalent employees, including sole traders, anywhere in Australia. Check business.gov.au for current eligibility.
Where do I find the exact wording of a law?
The Federal Register of Legislation at legislation.gov.au publishes the authorised versions and compilations.
Sources
- ASD's Australian Cyber Security Centre — hotline, ReportCyber, Essential Eight, Cyber Health Check
- business.gov.au — cyber security support and the Small Business Cyber Resilience Service
- IDCARE — Small Business Cyber Resilience Service
- Office of the Australian Information Commissioner — privacy and data breaches
- Scamwatch — reporting scams
