The government will help pay for your cyber uplift: the SME package, explained
An $18 million federal package now funds free cyber checkups and action plans for small businesses, alongside Cyber Wardens training. How to actually use it.
The federal government is putting real money behind small-business cyber security — free checkups, one-on-one help and staff training. Most eligible businesses will never claim any of it. Here's what's on the table and how to actually use it.
Small businesses have spent years being told to take cyber security seriously by people who then handed them a 40-page framework and left. That's finally shifting. Under Australia's 2023–2030 Cyber Security Strategy, the federal government has committed an $18 million package for small and medium businesses — funding free cyber "checkups" that assess where a business stands, one-on-one help for those that need it, and plain-language action plans to follow. Alongside it, the government-backed Cyber Wardens program — with $23.4 million behind it — offers free training aimed at putting a cyber-aware person inside tens of thousands of Australian small businesses. The money is real. The question is whether your business does anything with it.
What's actually in the package?
Free cyber checkups
an assessment of your current security posture: what you have, what's missing, what to fix first. Think of it as a bulk-billed health check for your IT.
One-on-one support
hands-on help for small businesses that need guidance acting on what the checkup finds, including businesses recovering from an incident.
Action plans
a written, prioritised list in plain English rather than a compliance framework, designed for businesses without an IT department.
Cyber Wardens training
free online courses that turn a nominated staff member into the business's eyes and ears for phishing, scams and basic cyber hygiene.
Why is the government paying for this?
Because small business is where Australia's cyber problem concentrates. Small businesses hold valuable data, connect to bigger organisations' supply chains, and mostly can't fund a security team — which makes them both the softest target and, collectively, a national vulnerability. It is cheaper for the government to fund prevention than to keep absorbing the economic damage of successful attacks. For you, the reasoning matters less than the result: work that would normally cost money is currently free.
The honest limits of free help
A checkup tells you what's wrong; it doesn't fix anything. A Cyber Warden can spot a phishing email; they can't configure conditional access or test your backups. Government programs are excellent at the awareness-and-assessment layer and stop exactly where the technical work starts. So the smart sequence is: take the free assessment, take the free training — then treat the action plan as a to-do list that someone technical actually executes. That last step is where most businesses stall, and it's the step that changes your risk.
How to use it — a practical sequence
1. Get a baseline now.
Take a government checkup when available — or start with our free cybersecurity health check, which covers the same ground with a security engineer reading the results.
2. Nominate a Cyber Warden.
Pick the staff member who already cares, and give them the free training. One aware person inside the business catches what filters miss.
3. Execute the action plan against a real framework.
The items on any credible plan will map to the Essential Eight — MFA, patching, backups, application control. Our Essential 8 assessment shows where you stand in about ten minutes.
4. Decide what's handled in-house and what isn't.
For most small businesses the honest answer is that nobody internal owns patching, monitoring and backup testing — which is what small-business IT support exists to fix, at small-business prices.
Frequently asked questions
Is my business eligible?
The package targets small and medium businesses broadly; specific eligibility and rollout details come from the government as each program opens. The Cyber Wardens training is already available free for small businesses.
Is the free government checkup as good as a paid assessment?
It's a genuine baseline and far better than nothing. A paid assessment goes deeper — actually testing controls rather than surveying them — and comes with someone accountable for fixing what's found. Do the free one first either way.
We did the checkup. Who fixes what it found?
That's the gap the package leaves, by design — the government funds assessment and guidance, not engineering. A managed provider (us, for many Melbourne and Australian small businesses) turns the action plan into completed work.
Where does the Essential Eight fit into this?
It's the framework behind most of the advice. The government's action plans, insurer questionnaires and our own uplift work all point at the same eight controls — so progress against the Essential Eight is progress against everything at once.
The next step
Free help only helps the businesses that claim it. Nominate your Cyber Warden this week, and get your baseline — the government's checkup when it's open to you, or our free health check now. Call 1300 053 948 if you'd rather just talk it through.
Related Key IT services
More insights
Your supplier's breach is your problem
An Australian hotel group's guest data was exposed through a third-party provider. Why supply-chain…
Read article →CybersecurityWhat a cyber incident costs an SMB
The ASD puts the average cybercrime cost for a small Australian business at $56,600 — up 14%. Where…
Read article →Cybersecurity'Too small to be a target' myth
Why small businesses are now prime cyber targets, the data behind it, and what affordable…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.