Name: House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations
Uploaded: 2026-10-05T23:05:00+00:00
Duration: 15660 s

00:00 - 01:19

Speaker 3

This hearing is occurring via video conference. I remind all participants to put themselves on mute unless they have been given the call to speak. And this will greatly help the broadcasting and transcription teams. I'd also like to take this opportunity to thank, to note that the committee has put out a survey to hear from small businesses and organisations about their experiences with cyber security. So this is an easy way for smaller business owners to make their voices heard by the committee.

And the survey is still open and would encourage everyone to put their survey in. Finally, I'd like to remind all members, witnesses and observers that this hearing should be conducted in a respectful and orderly manner. And if the proceedings are disrupted in any way, I will suspend the hearing until order is restored. I now welcome Ross Krielman from the Australian Chamber of Commerce and Industry to give evidence today. For the Hansard record, would you please state your name and the capacity in which you appear before the committee.

01:19 - 01:33

Speaker 1

Yes, thank you, Chair. My name is Ross Krielman. I'm the Associate Director for Digital, Cyber Policy, Digital, Cyber and Energy Policy at the Australian Chamber of Commerce and Industry.

01:33 - 02:01

Speaker 3

Great, thank you. This hearing is a legal proceeding of the Parliament. The giving of false and misleading evidence is a serious matter and may be regarded as a contempt of Parliament. And the evidence given today will be recorded by Hansard and attracts parliamentary privilege. So I now invite you to make a brief opening statement before we proceed to questions.

02:01 - 05:23

Speaker 1

Thank you, Chair. And good morning, Chair and members of the committee. And thank you for the opportunity to appear here today. The Australian Chamber of Commerce and Industry warmly welcomes this committee's inquiry and the survey which has been undertaken. These are extremely timely activities in the world of cyber security and business.

As mentioned, my name is Ross Krielman. I'm the Associate Director for Digital, Cyber and Energy Policy at the Australian Chamber of Commerce and Industry, or ACCI. I'm pleased to join you this morning from the lands of the Ngunnawal people in Canberra. ACCI is Australia's largest and most representative business network, representing businesses of all sizes, industries and regions. And small businesses are particularly important to that chamber network.

And we're pleased that you will be hearing later in the morning from some chamber members of the network. ACCI sits on the federal government's Executive Cyber Council, where I co-lead the small and medium business working group. And on the international side of things, I serve as the Vice Chair of the Digital Policy Committee at the Business at OECD grouping.

Our central message to the committee today is straightforward. For small business, the problem is not simply a lack of cyber security information or awareness. It is a capability and capacity problem. Small businesses know that cyber security is important. But many are operating with limited time, limited specialist expertise, and under significant cost and regulatory pressures.

Our submission notes that while around 70% of small businesses identify cyber security as a priority, only 24% report a high level of capability. There is already a considerable amount of good government guidance available. The challenge is making that guidance trusted, relevant, practical, and easy for small businesses to implement. Many businesses lack the time, the resources, expertise, and indeed the confidence to act on that advice. The same principle should guide government regulation in this area.

Cyber security requirements should be risk-based and proportionate, reflecting the sensitivity of the information involved and the services a business provides. When it comes to government procurement, we should avoid onerous conditions that might exclude otherwise very capable small and medium enterprises from participation without delivering a commensurate security benefit. Ultimately, our objective should be to help small businesses become more cyber resilient, rather than simply giving them more cyber reporting obligations. Thank you, and I look forward to the committee's questions.