2 November 2026 - For Immediate Release
Small businesses need a simpler way to understand and validate whether a cyber security or IT services provider has the skills to do the job, the Australian Computer Society (ACS) has told the House of Representatives Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations.
The evidence comes a week after the Australian Signals Directorate said it received more than 82,000 cybercrime reports in 2025-26, about one every six minutes. The average cost reported by a small business was $55,400.
Appearing before the inquiry today on behalf of ACS, CyberPath Technical Program Lead Jakub Zvěřina said businesses generally understand the importance of cyber security. The difficulty is deciding which risks to address, where to make investments into capability, who to engage, and how they can be sure that the work is done to a quality standard.
He described this as an implementation challenge. Australia already has many of the building blocks to address these challenges, but government and industry needed to bring existing initiatives together.
Mr Zvěřina said there was a gap in how capability is defined and assessed. Compliance frameworks often set out processes, technical controls, roles and responsibilities, but gave businesses limited help to establish whether the people doing the work could perform it to the required standard.
“A lot of the legislative instruments already exist such as the Security of Critical Infrastructure Act 2018 (SOCI), along with various compliance obligations that businesses have. The challenge around a lot of those compliance obligations is that they're very focused on processes and technical controls.
“Some of them do go as far as making sure that certain roles and responsibilities are defined, but there's nothing within a lot of those compliance frameworks which actually tell the story of, ‘can the people doing the work actually do their job', and what's the desired outcome?
“How do we know that they’re performing at the appropriate quality level?” he said.
ACS put forward CyberPath, a Commonwealth grant-funded pilot led by ACS in collaboration with industry partners, and co-designed through extensive industry engagement, as a foundation for making those judgements easier. The initiative links professional standards with practical experience and verifiable signals of competence in different industry contexts.
For small businesses, CyberPath could make buying cyber services less confusing by establishing common standards across practitioners, managed service providers and managed security service providers. This would give owners a clearer basis for assessing skills, comparing providers and understanding what each service covers.
It could also clarify accountability and responsibilities, including when AI is used as part of human-AI augmented work. That means establishing where obligations sit between the business, its practitioners and service providers, data owners and processors, technology vendors and platforms.
Mr Zvěřina said mentoring, collaboration and exercises such as simulated cyber incidents helped people develop and demonstrate their skills. Relevant learning should also include business leaders, procurement teams and other professionals whose decisions affect cyber risk. As well as supporting the development of practitioners, this approach could be extended through ‘trusted partners’ that SMBs turn to such as their accountants, banks, and service providers.
The purpose is to make it easier for businesses to find capable help and understand what they were buying.
“We don’t want to make it harder. We don’t want to introduce new legislation or regulatory requirements,” Mr Zverina said. Now more than ever, we need to bring the community together towards an approach of collective defence, ensuring nobody is left behind, including SMBs.
ACS CEO Dr Prins Ralston said: “Small business owners can readily verify a builder’s or electrician’s licence. Yet when choosing a provider to protect their systems and customers’ data, they often lack a clear, consistent way to assess capability.
“We are calling for a common standard, rather than a new licensing requirement, to help businesses compare providers, understand the services being offered and make informed decisions about who they trust.”
The committee is examining whether there are appropriate cyber security standards for small businesses and how easy it is for them to buy cyber security services. It holds its final public hearing on Wednesday and is due to report by 31 March 2027.
The CyberPath pilot starts in February. Employers and cyber security practitioners can register as early adopters at https://www.cyberpath.org.au/get-involved/MVP.html
ENDS
Further information
Troy Steer
Director of Corporate Affairs and Public Policy
M – 0417 173 740
E – troy.steer@acs.org.au
About ACS
The Australian Computer Society (ACS) is the professional body for Australia’s technology profession. Since 1966, we have championed a trusted, skilled, and world-class profession, representing 42,000 members across business, government and education, with branches in every Australian state and territory. Our work strengthens Australia’s digital sovereignty, responsible AI adoption, cyber resilience, workforce capability and digital trust. We set professional standards, accredit education, certify practitioners and advocate for the skills and capabilities Australia needs. ACS is committed to advancing the profession and ensuring technology serves Australia’s national interests and delivers lasting public value.
About Cyberpath
CyberPath is a Commonwealth grant-funded cyber professionalisation pilot led by ACS which brings together industry, government and education to standardise career and education pathways, skills requirements and recognition frameworks for cyber security.