For an Australian small business, almost none of the cyber security awareness training you are told to do is strictly mandatory — but several frameworks make it a practical requirement, and one thing really is compulsory: if your business holds personal information and it leaks, the Privacy Act's Notifiable Data Breaches scheme requires you to assess and report the breach. Training is how you cut the odds of being in that position in the first place. This guide separates the real obligations from the noise, so you can spend your training budget on what actually matters.
TL;DR
- No Australian federal law forces security awareness training on private businesses — but SMB1001 Bronze, ISO 27001 clause A.6.3 and PCI DSS 12.6 all require evidence of it in practice.
- If you hold personal information, the Privacy Act's Notifiable Data Breaches scheme is the hard legal edge: report eligible breaches to affected people and the OAIC.
- ASD's Essential Eight expects staff awareness as a supporting control, even though the eight strategies themselves are technical.
- ASD's Annual Cyber Threat Report 2024-25 puts the average self-reported cybercrime cost to small business at $56,600 — the business case for training is financial, not just regulatory.
- Want the frameworks without the audit? A security gap assessment shows which of these actually apply to you in about a day.
Why this matters in 2026
The average self-reported cost of cybercrime to an Australian small business hit $56,600 in FY2024-25, up 14% in a year, and business email compromise made up 15% of business cybercrime reports that year. Every one of those incidents starts with a person — a clicked link, a fake invoice, a password handed over. Regulators and insurers have noticed: cyber insurance applications now ask for training records, enterprise clients put security clauses in contracts, and certification bodies want evidence, not intentions. Understanding which requirements actually bind you is the difference between buying what a tender requires and buying what a salesperson says you need.
The frameworks, one by one
SMB1001 (mandatory at Bronze tier)
SMB1001 is the certification standard built for small and midsize businesses, and its Bronze tier makes staff security awareness a hard requirement: everyone with system access must complete awareness training at least annually, with records kept as evidence for the certifying assessor. If you are pursuing SMB1001 — increasingly common for Australian businesses chasing government contracts or insurance credibility — training is not optional. Cyber Aware's security awareness training maps directly to the standard so completion records double as certification evidence.
ISO 27001 (A.6.3)
ISO 27001, the international information security standard, requires awareness, education and training activities for personnel under control A.6.3 in its Annex A. Certification audits ask for completion records and refresher evidence, not good intentions. If a client contract requires ISO 27001, annual training with a per-learner record is part of the certification cost whether you like it or not.
PCI DSS (requirement 12.6)
Businesses that handle card payments must run security awareness training for personnel who handle cardholder data, on hire and at least every 12 months, with signatures or attestations. If you take cards — most businesses do — PCI DSS applies through your payment provider even if nobody ever audited you directly.
Essential Eight (recommended baseline)
The Australian Signals Directorate's Essential Eight is a set of eight technical mitigation strategies — patching, MFA, backups and so on — and it does not mandate a training course. But applying any maturity level meaningfully assumes staff recognise phishing and know how to report it, and maturity assessments increasingly ask for evidence the human layer is trained alongside the technical controls. Treat it as strongly recommended, not required.
Privacy Act / Notifiable Data Breaches (the legal edge)
This is the one with real legal teeth. If the Privacy Act covers your organisation and personal information is accessed, disclosed or lost in ways likely to result in serious harm, the Notifiable Data Breaches scheme requires you to notify affected individuals and the OAIC. There is no federal mandate to run training — but a workforce that recognises phishing and reports it is the cheapest way to stay out of that regime entirely. Training is risk reduction with a compliance dividend, not a legal checkbox.
What is simply recommended
Industry associations, insurers, government tenders and enterprise clients increasingly ask for proof of staff awareness training even where no law requires it. The practical reality in 2026: most Australian small businesses run training not because a regulator made them, but because a client, an insurer or a tender panel did.
How to know which apply to you
Three questions sort it in a minute:
- Do you hold anyone's personal information? The Privacy Act and its breach-reporting duties likely apply — training is your first line of prevention.
- Are you chasing or holding a certification? SMB1001, ISO 27001 or PCI DSS each carry their own training evidence requirement — check the specific clause, not the marketing summary.
- Do clients or insurers ask for security evidence? Even without formal certification, expect security questionnaires that want training completion records — a human risk reporting dashboard answers these on demand.
If the answer to all three is not sure, run a security gap assessment — it scores your current setup against the frameworks above and shows exactly which requirements you meet, miss or partially meet.
Setting up training that satisfies the requirements
Whatever framework drives you, the evidence looks the same: assigned modules, completion records, and a phishing-simulation programme that shows the training changed behaviour rather than just filling a quota. Monthly short modules plus a monthly phishing simulation — the Cyber Aware model — produces exactly the evidence trail auditors, assessors and insurers ask for, automatically. Before buying anything, compare the platforms on evidence and reporting, not just price: the platform comparison breaks down what each vendor gives you.
FAQ
Is security awareness training legally required in Australia? No federal law forces it for private businesses. But SMB1001 Bronze requires it for certification, ISO 27001 requires it under A.6.3, PCI DSS requires it under 12.6 for card handlers, and the Privacy Act's Notifiable Data Breaches scheme makes breach response (which training reduces the odds of needing) compulsory.
Does the Essential Eight require staff training? Not directly — the Essential Eight's eight strategies are technical controls. But reaching any maturity level assumes staff who recognise phishing and report it, so awareness training is a supporting control most assessors expect to see evidence of.
What is SMB1001 and does it apply to us? SMB1001 is a cyber security certification standard built for small and midsize businesses. Its Bronze tier requires annual staff awareness training with records. It applies if you're pursuing certification — often for government work, insurance credibility or enterprise clients.
How often should staff be trained for compliance? Annually is the minimum across ISO 27001 and PCI DSS; monthly micro-training is the practical 2026 standard because it produces the evidence trail and the behaviour change, not just a certificate.
What happens if we don't do training and there's a breach? If personal information is exposed and the Privacy Act covers you, you must assess and possibly report the breach regardless of training. No training doesn't add a fine by itself — but it makes a breach more likely, harder to explain to the OAIC, and much harder to justify to an insurer or client afterwards.
How do we prove training happened? Keep per-learner completion records with dates, plus phishing-simulation results over time. A human risk reporting dashboard produces this automatically — no manual spreadsheets, and it's the format assessors and insurers recognise.
One last thing
Compliance requirements are the floor, not the ceiling. The businesses that actually avoid incidents treat training as risk reduction first — the $56,600 average incident cost is the number to beat, and the training budget is a rounding error against it.