House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations — hearing of 16 October 2026: transcript & video · Polyfact

Free trial Learn more

United Kingdom en

Language

Videos

United Kingdom en

Language

Learn more Log in Free trial

House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations

15 October 2026

Contents updated on 16 Oct 2026

Hearing of the House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations with officials from the Department of Home Affairs.

Layout

Layout Balanced Video, transcript and chat in equal parts Video Larger player Reading Wider transcript

Legend

Transcript markers

text Sentence being played
text Search result
text Intervention cited by the link you opened

Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.

More options

Official source

Offset

Transcript offset

0s

Text size

Export

Select segments to export (Word)

0 segments selected

Public hearing with Department of Home Affairs

16:45

Opening statements

16:45

Sally Sitou — Opening of the hearing and procedural remarks

16:45

Kirsty Spencer — Introduction

18:07

Angus Kirkwood — Introduction

18:13

Greta Doherty — Introduction

18:16

Sally Sitou — Reminder on evidence and invitation to open statement

18:22

Kirsty Spencer — Opening statement on SME cyber vulnerabilities

18:48

Intervenant 4 — Continuation of opening statement on CyberSmart and Horizon 2

19:51

CyberSmart program — Standards, certification and insurance

22:13

Question of Sally Sitou on the design of the CyberSmart standard and certification tiers

22:13

Question of Sally Sitou on using CyberSmart certification in procurement and supply chains

25:28

Question of Sally Sitou on proportionate government requirements for SMEs

28:15

Question of Sally Sitou on linking CyberSmart certification with cyber insurance

31:06

Cyber security training and the human factor

34:22

Question of Intervenant 11 on effective employee cyber training as a human firewall

34:22

Question of Intervenant 11 on AI‑driven threats and the limits of the human firewall

37:53

CyberSmart program — Standards, certification and insurance (cont.)

40:01

Question of Intervenant 11 on the Protective Security Policy Framework and impacts on SMEs

40:01

Question of Intervenant 19 on measuring SME uptake of cyber security practices and CyberSmart trust marks

41:53

Cyber security for connected vehicles and small business fleets

45:45

Question of Intervenant 24 on cyber security risks for small business connected vehicle fleets

45:45

CyberSmart program — Standards, certification and insurance (cont.)

47:52

Question of Intervenant 29 on usage patterns of government cyber resources and repeat visitation by small businesses

47:52

Question of Intervenant 29 on multiple sources of cyber advice and cyber.gov.au as single source of truth

50:19

Question of Sally Sitou on obtaining more granular usage data for government cyber resources

53:04

Question of Sally Sitou on professionalising cyber security advisors and guidance for small businesses

53:54

Question of Sally Sitou on barriers to small business uptake of cyber insurance

57:23

Public hearing with Australian Signals Directorate

58:44

Introduction of ASD witnesses and opening of new hearing segment

58:44

Opening statements

59:41

Stephanie Crowe (ASD) — Outline of ASD roles and cyber support to Australian businesses

59:41

ASD incident response and support services for SMEs

01:01:32

Question of the Chair on what ASD’s response to small business cyber incidents involves

01:01:32

Question of the Chair on best and worst case lifecycles of cyber breaches for small businesses

01:02:53

Question of the Chair on ongoing engagement between ASD and affected small businesses

01:05:50

Question of the Chair (Sally Sitou) on the Infosec Registered Assessors Program (IRAP) list of trusted cyber professionals

01:06:39

Question of Ms Claydon on how ASD selects which small business incidents to respond to

01:07:47

Question of Ms Claydon on the most critical impacts that trigger ASD support

01:09:41

Question of Ms Claydon on prioritising ASD guidance tools for time-poor small businesses

01:10:47

Question of Ms Claydon on usage of ASD tools and overall resilience of the small business sector

01:14:10

Question of Mr Abdo on obligations of companies after major data breaches

01:16:47

Follow-up question of Mr Abdo on whether companies adequately inform customers about data breach impacts

01:19:04

Question of Mr Abdo on which government body oversees company responsibilities after data breaches

01:21:28

Question of Mr Abdo on an ASD-style essential framework for small businesses

01:22:21

Response of ASD official on SME cyber handbook and AI-related guidance

01:22:55

Cyber security for connected vehicle fleets used by small businesses

01:24:34

Questions of Ms Aldred on connected vehicles and small business fleets

01:24:34

ASD incident response and support services for SMEs (cont.)

01:30:11

Question of Ms Templeman on usability and support for Exercise in a Box

01:30:11

Questions of Ms Templeman on hotline human support and call data

01:32:23

Cyber threat intelligence sharing and visibility of incident trends

01:35:25

Question of Ms Sitou on cyber threat intelligence sharing with insurers

01:35:25

Question of Ms Sitou on completeness of ASD’s view of the cyber threat landscape

01:38:05

Cyber.gov.au single entry point and governance

01:39:31

Question of Ms Sitou on governance and whole-of-government content of cyber.gov.au

01:39:31

Public hearing with Australian Institute of Criminology

02:00:06

Cybercrime survey methodology, SME victimisation trends and protective behaviours

02:00:06

Questions of Ms Sitou on SME cybercrime trends, survey design and protective measures

02:00:06

Questions of Ms Clutterham on cyber insurance, ransom payments, repeat victimisation and reporting barriers

02:09:24

Question of Ms Sitou on SME use of personal devices for work

02:18:01

Question of Ms Templeman on key concerns and trends over time

02:19:42

Public hearing with Department of the Treasury

02:28:41

Resumption of hearing and introduction of Treasury witnesses

02:28:41

Opening statements

02:29:42

Ms Polygenis (Treasury) — Opening statement on small business cyber needs and support programs

02:29:42

Treasury small business cyber programs, incentives and engagement

02:35:58

Questions of Ms Sitou on Treasury’s role in CyberSmart and connections to existing support programs

02:35:58

Questions of Ms Sitou on tax incentives and other levers to encourage small business cyber uplift

02:39:11

Questions of Ms Clutterham on effective channels to reach and engage small businesses

02:43:55

Questions of Ms Clutterham on ideal program design for small business cyber support

02:48:43

Question of Ms Clutterham on Treasury advice about paying ransoms

02:53:25

Questions of Ms Aldred on regional participation in the Cyber Wardens program

02:53:51

Questions of Ms Aldred on administration costs of the small business cyber resilience service

02:55:44

Questions of Ms Aldred on uptake and findings of the cyber health check tool

02:58:01

Questions of Ms Sitou on adapting the Cyber Wardens model for targeted SME training

02:59:19

Questions of Ms Sitou on early findings from the Cyber Resilience Service evaluation

03:02:14

Questions of Ms Sitou on barriers to small business uptake of cyber insurance

03:04:36

Questions of Ms Sitou on UK-style accreditation bundled with cyber insurance

03:06:58

Questions of Ms Sitou on proportional procurement cyber requirements for SMEs

03:08:51

Public hearing with OAIC and ACCC

03:45:07

Opening statements

03:45:07

Opening of OAIC and ACCC session, witness introductions and decision not to make opening statements

03:45:07

Notifiable data breaches, small business privacy obligations and AI-related incidents

03:46:49

Questions of Ms Clutterham on OAIC data breach reporting requirements and use of reported data

03:46:49

Questions of Ms Clutterham on gaps caused by the $3 million small business exemption

03:50:16

Questions of Ms Clutterham on the complexity of notifiable data breach reporting for businesses

03:50:53

Questions of Ms Clutterham on whether the serious harm threshold and regime remain fit for purpose

03:52:24

Questions of Ms Clutterham on extending reporting obligations to small businesses and compliance burdens

03:54:37

Consumer behaviour, business reputation and scam impacts on small businesses

03:57:13

Questions of Ms Clutterham on whether cyber security influences consumer behaviour and expectations

03:57:13

Questions of Ms Clutterham on the effectiveness of Scamwatch for consumers and small businesses

03:59:00

Questions of Ms Clutterham on changing scam trends impacting small businesses

04:00:22

Questions of Ms Templeman on streamlining scam and cyber information and engaging disengaged small businesses

04:01:50

Notifiable data breaches, small business privacy obligations and AI-related incidents (cont.)

04:14:47

Questions of the Chair to OAIC on sectoral data breach trends and supply-chain impacts on small businesses

04:14:47

Live capture

Versions of this video

Replay Final version · 15 October 2026
Live capture Streamed live on 15 October 2026

Current

Transcripts may differ slightly from one version to another.

House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations

15 October 2026

House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations Thu, 15 Oct 2026 Parliament of Australia

Follow its sittings

16:45 - 18:07

Member of the House of Representatives | Reid (NSW)

Sally Sitou

Good morning and welcome to this public hearing of the Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations. I'm Sally Situ, I'm the chair of the committee and I'd like to begin by acknowledging the traditional owners on the land on which we meet and are calling in from today and pay my respects to elders past, present and emerging. This hearing will be broadcast on the Parliament's website and the proof and official transcripts of the proceedings will be published on the committee's web page. And I remind members of the media who may be present or listening on the web of the need to be to fairly and accurately report the proceedings of the committee.

And I'd like to take this opportunity to note that the committee has put out a survey to hear from small businesses and organisations about their experiences with cyber security. This is an easy way for small business owners to make their voices heard by the committee and the survey is still open and available on the inquiry website. I now call I now welcome representatives from the Department of Home Affairs to give evidence today. For the Hansard record, could you please state your name and capacity in which you appear before the committee?

18:07 - 18:13

Kirsty Spencer

Deputy Secretary Law Enforcement and Domestic Security, Department of Home Affairs

Kirsty Spencer, Deputy Secretary Law Enforcement and Domestic Security at the Department of Home Affairs.

18:13 - 18:16

Angus Kirkwood

Acting National Cyber Security Coordinator

Angus Kirkwood, Acting National Cyber Security Coordinator.

18:16 - 18:22

Greta Doherty

First Assistant Secretary, Counter Foreign Interference, Cyber and Technology at the Department of Home Affairs

And Greta Doherty, First Assistant Secretary Counter Foreign Interference Cyber and Technology at the Department of Home Affairs.

18:22 - 18:48

Member of the House of Representatives | Reid (NSW)

Sally Sitou

Great. Thank you very much for being here. This hearing is a legal proceeding of the parliament. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege.

I now invite you to provide a brief opening statement before we proceed to questions.

18:48 - 20:33

Kirsty Spencer

Deputy Secretary Law Enforcement and Domestic Security, Department of Home Affairs

Thank you. Small and medium sized businesses and not-for-profit organisations are the backbone of Australia's economy and communities, yet too many remain vulnerable to cyber threats. And unlike other national security risks, cyber security threat is always certain.

Basic protections, such as multi-factor authentication and timely software updates, are not consistently in place, while limited resources, expertise and time can make cyber security feel costly, complex and out of reach. The result is significant harm. As outlined in our submission, cybercrime is estimated to cost small businesses around $12 billion each year. Many small organisations want to improve their cyber security but struggle to navigate the fragmented guidance, apply technical standards or access affordable expert support. We've heard through multiple rounds of consultation on our cyber security strategy that small and medium businesses want practical, proportionate and accessible help that reflects the realities of running a small organisation.

The government's new CyberSmart program and CyberSmart Hub are designed to help meet that need. Together, they will provide tiered cyber security benchmarks and affordable certification pathways, practical tools and resources, and tailored support for small businesses and not-for-profit organisations. By making cyber security simpler, more achievable, and more relevant, CyberSmart will help build stronger foundations for resilience across the economy. Under Horizon 2 of the Australian Cyber Security Strategy, we're focusing on the important role of supporting workers in smaller entities to be more cyber aware and resilient. We know that people remain one of the most important lines of cyber defence.

Ask anything about this video — I analyse its transcript to answer.

Parliament of Australia

Read the full session, transcribed live

One free trial opens the sessions transcribed word for word, with AI summaries and chat, the biographies of your parliament's members, alerts, and your questions to Claude or ChatGPT.

Live transcript, every speaker identified
The biography of every member of your parliament, with its assistant
Alerts on your keywords, and your questions to Claude or ChatGPT

Every video is free to watch, live and on replay, no account needed.

14-day free trial · cancel anytime

Free trial Learn more

Already have an account? Log in

Keyboard shortcuts

Playback

Play / pause: Space
Back / forward 15 s: ←→
Back / forward 10 s: JL
Full screen: F

Chapters and transcript

Previous / next chapter: PN
Search the transcript: /
Turn follow on / off: S
Copy the current sentence as a quote: C
Show this help: ?

Single-key shortcuts J, L, N, P, C, S, / and ?. Turn them off if you use voice control or assistive tech that types letters.

Inactive while a text field, a button or the chat has focus.