Guides: straight answers to common questions.
Each guide opens with a short answer, shows the date it was last checked and links to the primary source: ASD, the OAIC, legislation and AUSTRAC. General information, not legal advice.
Does the Privacy Act apply to my small business?
Often not: the Privacy Act generally does not apply to a business with an annual turnover of $3 million or less.
Essential Eight and the new ASD Essentials: where should a small business start?
The Australian Signals Directorate (ASD) published the ASD Essentials on 15 October 2026 as an evolution of the Essential Eight.
Cyber insurance questionnaire: how to answer the MFA, backup, EDR and patching questions
Answer from what you can show, not from what you assume or were told.
What should a certificate of destruction list, and why isn't a factory reset enough?
A certificate of destruction should identify each device by serial number, say what method was used, when, by whom and who witnessed it, give the verification result and tie back to a collection record.
The first 30 days after a data breach under the NDB scheme
If the Privacy Act applies to you and you suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to finish it within 30 days of becoming aware of the grounds for suspicion.
Looking for something shorter? See the questions about oowl, the blog or the threat briefs. Or run the free email spoofing check.