The 1-to-5 Person Business: A Security Playbook for the Smallest Teams

Most security advice quietly assumes you have an IT person. But the majority of Australian businesses are sole traders and micro teams where the founder IS the IT department — between quoting, invoicing and doing the actual work. The good news: at this size, five deliberate choices cover most of your risk, and none of them needs a consultant on retainer.

Why attackers bother with a two-person business

Because it’s automated. Nobody handpicks you — bots phish every ABN with an email address, and a micro business has exactly what they want: a bank account that pays invoices, an email address customers trust, and no security team watching. The attack that hits a big corporate and the attack that hits a two-person plumbing outfit is often literally the same email.

The five choices that carry the load

• 1. One protected identity: your email account resets everything else you own. Give it a unique passphrase and app-based MFA today — this single move outranks everything else on this list.
• 2. A password manager, even solo: unique passwords per site without memorising anything, and one shared vault ready for employee number two.
• 3. Automatic everything: updates on for the laptop, the phone and the browser. At this size, patching policy is a checkbox — tick it.
• 4. One real backup: your laptop dying and your files being encrypted are the same event to your business. Cloud backup with version history (not just sync — sync faithfully copies ransomware too) covers both.
• 5. The payment ritual: any change of bank details — from a supplier, a customer, anyone — gets a phone call to a number you already had. You are your own finance department; be a suspicious one.

What you can safely skip (for now)

You don’t need a SIEM, a firewall appliance or a 40-page policy. You DO need the five moves above plus one habit: when something feels off — a weird login alert, an invoice you don’t remember — stop and check before clicking. When you grow past a handful of staff, revisit the Essential Eight properly; until then, this playbook is honestly most of the game.