Interactive
Every one is a real SMB1001 control failure, and every one turns up in ordinary Australian small businesses. Find them, then see what each actually costs to fix. Most of them are free.
Tap a marker to see what it breaches.
Stuck to the monitor bezel, in a room that visitors and contractors walk through. It is the single most common finding in any assessment.
The fix: Free. A password manager, which the standard requires from Silver anyway, removes the reason anyone writes one down.
The dust is the finding. Nobody knows when it was last written to, whether it still works, or what is on it.
The fix: Free to check, and the answer matters more than the drive. Plug it in, attempt a restore, write down what happened.
Names, addresses and phone numbers visible on a machine nobody is sitting at, in a room with foot traffic.
The fix: Free. A four-minute screen lock policy, and a habit. This is culture, not technology.
One account everyone uses. It means no audit trail: if something goes wrong you cannot say who did it, only that somebody did.
The fix: Usually free on existing licensing. Individual accounts, and remove the shared one.
Paper with client details going out with the co-mingled recycling, which is handled by people you have never met.
The fix: About $60 for a cross-cut shredder, plus a written note of what must be shredded rather than binned.
Deleting files does not remove them, and a quick format usually does not either. The drive still holds whatever was on it.
The fix: Free if the drive was encrypted: destroy the key. Otherwise a secure erase, and write down that you did it.
Closed, dusty, three months out of date. A register nobody fills in is worse than none, because it looks like a control while providing nothing.
The fix: About $4 for a bound notebook. The cost is remembering to use it, not buying it.
Deferred often enough that the machine is months behind. Most successful attacks use a flaw that was patched long ago.
The fix: Free. Turn automatic updates on and let them run outside working hours.
The point
Compliance has a reputation for being expensive, and the expensive part is usually the technology nobody needed. Most of what SMB1001 asks for at the lower tiers is habit, documentation and turning on things you are already paying for.
The awkward part is not fixing these. It is knowing which ones you have, which is what a gap assessment is for: someone goes through your actual environment against the actual controls and tells you plainly where you stand.
