Chartered Accountants Australia and New Zealand (CA ANZ) welcomes the opportunity to contribute to the House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations (SMBOs). We support simple, affordable and continuous cyber security support from government for small businesses.

Our submissions to date have recommended government support in the form of practical tools, cyber health checks and action plans. Since those submissions, guidance and tools must now include the use and impact of artificial intelligence (AI) across our digital economy. Accordingly, AI governance, cyber security and data protection should not be treated as separate policy silos. AI is now embedded in many everyday business tools and can create new data exposure, governance and training risks.

Key to government actions is recognition that SMBOs face information overload rather than information scarcity. With limited resources, small business owners do not know where to start, what to prioritise, what represents value for money, whether they are doing enough, and how often to review controls their controls.

We strongly support the proposed actions in the government’s Action Plan for Horizon 2 that draw resources into one hub and focus those resources for SMBOs. Specifically, under Action 1.2, to create a dedicated, centralised CyberSmart Hub as a repository of resources for SMBOs and to enhance the Cyber Health Check Tool to be targeted to SMBOs. We also support the continuation of the Cyber Awareness Support for Vulnerable Groups grants program under Action 1.3 which is open to sole traders and small businesses.

Ultimately, government guidance for SMBOs should be;

• centralised through a single trusted entry point
• written in plain language and supported by industry terminology only where necessary
• supported by checklists, case studies and decision tools
• linked to practical next steps, including incident response, health checks and trusted support, and
• updated regularly to reflect emerging threats, including AI-enabled threats.

We support a fit-for-purpose SMBO cyber standard and a tailored standard and certification regime. Critically, government must recognise that, for SMBOs, the likely candidate to seek training and certification is the owner, not a dedicated IT professional. Therefore training through to certification should be provided by government.

AI is increasing both cyber risk and complexity, including AI-enabled attacks, faster vulnerability exploitation, increased data exposure risks and the embedding of AI into everyday business technologies. Many SMBOs may use AI without understanding how data is processed, stored, shared or exposed. For SMBO cyber security, the immediate policy need is practical guidance on AI use in business settings. Guidance could outline what information should not be entered into AI tools, how to assess AI tools before use and how AI features embedded in ordinary software may affect data handling and security.

Government guidance and initiatives should be assessed not only by whether it exists, but by whether SMBOs can act on it.