Secure by Design: What It Means for Small Businesses

Zac Tassone

Published 4 December 2023 · Updated 22 October 2026

“Secure by design” is a phrase you will see more and more on cyber.gov.au and in software marketing. At its heart is a simple idea: security should be built into a product or project from the start, not bolted on after something goes wrong.

You do not need to write software for this to matter. Every small business buys technology, signs up to cloud services and changes how it works over time. This guide explains what secure by design means for a business of 5 to 50 people, how to use it when choosing technology, and how to apply the same thinking to your own projects.

What does “secure by design” mean?

For manufacturers and software companies, secure by design means taking responsibility for security instead of leaving it to customers. Products should be safe out of the box: no shared default passwords, security features switched on by default, multi-factor authentication included as standard, and updates delivered for a clearly stated period.

The Australian Signals Directorate (ASD) has promoted this approach with international partners for several years. Its guidance “Choosing secure and verifiable technologies”, co-led with agencies from the United States, Canada, the United Kingdom, New Zealand and South Korea, is aimed at organisations buying technology and encourages them to build security into the buying process.

Why it matters for small businesses

• You inherit your suppliers’ weaknesses. If your accounting app, website plugin or router has a flaw, attackers can use it against you.
• Fixing security later is harder. Turning on MFA, restructuring permissions or replacing an insecure system after it is embedded in your business takes far more effort than choosing well upfront.
• Clients and insurers ask questions. Larger clients increasingly send security questionnaires to their suppliers, and cyber insurers ask about MFA, backups and patching.
• Small teams have less time to babysit technology. Products that are secure by default save you ongoing work.

Part 1: Buying technology that is secure by design

Before you sign up for new software, a cloud service or a device, ask the supplier these questions. A good supplier will answer them easily.

1. Does it support multi-factor authentication, and can we enforce it for all users?
2. Does it work with our existing sign-in? Single sign-on with Microsoft 365 means one place to remove access when someone leaves.
3. Are secure settings on by default? Or do we have to find and switch them on?
4. How long will it receive security updates? Get a date, not “for the foreseeable future”.
5. Where is our data stored, and who can access it? This matters for privacy obligations and client expectations.
6. How do you handle security issues? Is there a way to report vulnerabilities, and will you tell us if our data is affected?
7. Can we get our data out if we leave? In a usable format, without unreasonable delays.
8. Can we see who did what? Audit logs help you investigate if something goes wrong.

For smart devices, the law now helps. From 4 March 2026, most consumer smart devices made for the Australian market must avoid universal default passwords, offer a way to report security issues and state how long they will receive security updates. Business-grade equipment is not always covered, so ask the same questions anyway.

Part 2: Applying secure by design inside your business

The same principle works for your own changes: a new office fit-out, a website rebuild, moving to the cloud or adding a new system. Put security on the agenda at the start, not at go-live.

Start with a quick risk check

Ask what data the project touches, who needs access and what would happen if it was unavailable or leaked. Ten minutes of thought upfront shapes better decisions.

Give people only the access they need

Least privilege means staff, contractors and apps get the minimum access required for their role. Admin rights should be rare and separate from everyday accounts.

Use layers of protection

No single control is perfect. Combine MFA, patching, endpoint protection, email filtering and backups so one failure does not lead to a disaster. The Essential Eight is the best framework for Australian businesses here, and our guide to the ASD Essential Eight explains how to implement it.

Plan for updates and end of life

Every system needs an owner, an update routine and a replacement date. Unsupported software and hardware are among the easiest ways in for attackers. Our lifecycle and asset management service keeps track of this for you.

Build security into your website

Websites are a common target. Choose well-maintained platforms and plugins, keep them updated, use MFA for admin logins and keep regular backups. If you are planning a new site, raise these points with your website design team before the build starts.

Quick checklist

• Use the eight supplier questions above for any new technology.
• Prefer products with MFA, single sign-on and secure defaults.
• Get a stated security update period for every device and app.
• Add a security check to the start of every IT project.
• Apply least privilege to staff, contractors and apps.
• Keep a register of systems with owners and end-of-life dates.