Parliament is looking at how well small businesses are coping with cybercrime, and it wants to hear from owners directly. The House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations holds its first public hearing today, Tuesday 6 October.
Committee chair Sally Sitou MP set out the thinking when the hearings were announced. "Running a small business is demanding enough without having to worry about cyber criminals targeting your operations, customer data or finances," said Ms Sally Sitou MP, Chair of the Committee. "We want to hear what's working, what's not, and what government, industry and cyber security experts can do to better support small businesses to deal with modern day cyber threats."
What it will examine
The House set up the committee on 4 June 2026. Its terms of reference cover the cyber maturity of Australian small and medium businesses and not for profits, and whether the guidance government gives them is adequate, appropriate and easy to access. It will also look at whether suitable standards exist, how easy it is to buy cyber security services in Australia, and how much employee training matters.
One item is aimed squarely at supply chains. The committee will look at how a business's cyber security maturity affects its ability to work with government and large corporates.
When the inquiry began in July, Ms Sitou said: "This is the first federal inquiry to take a close look at the cyber security challenges facing small and medium-sized businesses." The committee will present its final report by 31 March 2027.
The cost so far
Much of the data behind the inquiry comes from the Australian Signals Directorate. Its Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in the financial year, an average of one every six minutes. The average self reported cost of cybercrime per report for small business was $56,600, up 14%.
Those costs are what businesses chose to report, so they will not capture every incident.
Cyber security also weighs on owners' minds. A 2024 survey by the Council of Small Business Organisations of Australia and the Cyber Wardens program, reported by Dynamic Business, ranked it the third biggest concern for small businesses, behind energy prices and the cost of staff. More than half of the small businesses surveyed, 51%, believed cyber threats posed a medium or high risk to their business.
How to have your say
Written submissions closed on 28 August, so the main way in now is the committee's short stakeholder survey, open until 29 January 2027. The committee says it is designed to be quick and easy to complete. Insurance News reports that it asks about experiences with cyber incidents, the cost of security measures, and how accessible advice and support are.
You can also follow the hearings. They are broadcast live at aph.gov.au/live, and detailed programs for each one will appear on the committee's website. The site also lets you track the committee and receive email updates.
Dates to note
Today's hearing is the first of seven. The others are on Friday 16 October, Monday 19 October, Tuesday 20 October, Thursday 22 October, Monday 2 November and Wednesday 4 November. The committee says it will hear from small businesses and organisations, cyber security experts, government officials and sector groups, among others.