House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations
15 October 2026
Contents updated on 16 Oct 2026
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Official source
Offset
Transcript offset
0s
Text size
Export
Replay
Versions of this video
Transcripts may differ slightly from one version to another.
16:45 - 17:39
Speaker 8
Good morning and welcome to this public hearing of the Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations. I'm Sally Sitou, I'm the chair of the committee and I'd like to begin by acknowledging the traditional owners on the land on which we meet and are calling in from today and pay my respects to elders past, present and emerging. This hearing will be broadcast on the Parliament's website and the proof and official transcripts of the proceedings will be published on the committee's webpage. And I remind members of the media who may be present or listening on the web of the need to be to fairly and accurately report the proceedings of the committee. And I'd like to take this opportunity to note that the committee has put out a survey to hear from small businesses and organisations about their experiences with cyber security.
17:39 - 18:07
Speaker 7
This is an easy way for small business owners to make their voices heard by the committee and the survey is still open and available on the inquiry website. I now call I now welcome representatives from the Department of Home Affairs to give evidence today. For the Hansard record, could you please state your name and capacity in which you appear before the committee.
18:07 - 18:13
Speaker 4
Kira Spencer, Deputy Secretary Law Enforcement and Domestic Security at the Department of Home Affairs.
18:13 - 18:16
Speaker 1
And Angus Coles, Acting National Cyber Security Coordinator.
18:16 - 18:23
Speaker 3
And Greta Doherty, First Assistant Secretary Counter Foreign Interference Cyber and Technology at the Department of Home Affairs.
18:23 - 18:48
Speaker 6
Great, thank you very much for being here. This hearing is a legal proceeding of the Parliament, the giving of false or misleading evidence is a serious matter and may be regarded as a contempt of Parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. I now invite you to provide a brief opening statement before we proceed to questions.
18:48 - 22:12
Speaker 4
Thank you. Small and medium sized businesses and not-for-profit organisations are the backbone of Australia's economy and communities, yet too many remain vulnerable to cyber threats. And unlike other national security risks, cyber security threat is always certain. Basic protections such as multi-factor authentication and timely software updates are not consistently in place, while limited resources, expertise and time can make cyber security feel costly, complex and out of reach. The result is significant harm and as outlined in our submission, cybercrime is estimated to cost small businesses around $12 billion each year.
Many small organisations want to improve their cyber security but struggle to navigate the fragmented guidance, apply technical standards, or access affordable expert support. We've heard through multiple rounds of consultation on our cyber security strategy that small and medium businesses want practical, proportionate, and accessible help that reflects the realities of running a small organisation. The government's new CyberSmart program and CyberSmart Hub are designed to help meet that need. Together, they will provide tiered cyber security benchmarks, an affordable certification pathway, practical tools and resources, and tailored support for small businesses and not-for-profit organisations. By making cyber security simpler, more achievable, and more relevant, CyberSmart will help build stronger foundations for resilience across the economy.
Under Horizon 2 of the Australian Cyber Security Strategy, we're focusing on the important role of supporting workers in smaller entities to be more cyber aware and resilient. We know that people remain one of the most important lines of cyber defence. Practical role-based training that helps staff recognise threats, protect information, and respond appropriately to suspicious activity will continue to be essential. The Executive Cyber Council, chaired by the Minister for Cyber Security, provides a senior public-private forum for government and industry to work together on shared national cyber security priorities, helping ensure policy and industry perspectives are brought together to support the objectives of the Australian Cyber Security Strategy. The Council includes representation for small to medium businesses and is operationalised by several working groups, which progress initiatives across small and medium business resilience, cyber workforce, sovereign cyber capability, and emerging technology.
As the strategy moves through Horizon 2, the focus of the working groups is increasingly on practical initiatives that can deliver tangible value and respond flexibly to emerging priorities. Strengthening cyber resilience is not just an important tool to protect businesses, it will also help smaller organisations participate more confidently in government, corporate, and critical infrastructure supply chains. A consistent CyberSmart certification framework could reduce assurance burdens while providing customers and partners with greater confidence in an organisation's cyber maturity. The Australian government is committed to ensuring that small and medium-sized businesses and not-for-profit organisations have the tools, support, and confidence to operate securely in the digital economy. Through practical guidance, accessible standards, and affordable services, CyberSmart will help make cyber security a realistic and achievable goal for organisations of every size.