Up to $8.1 million to build the cyber resilience and capability of small businesses, and provide support to small businesses impacted by a cyber incident.
Current status of program
CLOSED
To register your interest in future rounds or discuss alternative grant opportunities please contact us here.
On this page you will find
What is the Small Business Cyber Resilience Service (SBCRS)?
The Small Business Cyber Resilience Service grant opportunity (the program) will run over 3 years from 2024-25 to 2026-27. The program was announced as part of the 2023-2030 Australian Cyber Security Strategy. Under Shield 1 of the Strategy, Strong businesses and citizens, the program will support small businesses to build their cyber security resilience and capability.
Small businesses have rapidly digitised, bringing new opportunities but also increasing their vulnerability to cyber incidents. Cyber incidents can cause financial loss, reputational damage, and interruption to trading, with small business having limited ability to absorb losses.
Small businesses face unique barriers to strengthen their cyber security as they have limited knowledge, time, staffing and resources to invest in cyber security. Small business owners need help navigating cyber security information and applying it to their business.
SBCRS level of support
Grants
- Minimum amount – Not indicated
- Maximum amount – $8.1 million
- Up to 100% of eligible project expenditure
Applications are expected to be for the maximum grant amount available. You are responsible for the remaining eligible and ineligible project costs.
If your service receives funding from another Commonwealth, State or Territory government program, only additional activities and clients under this grant can be funded.
SBCRS important dates
- This program is currently closed
- Register your interest here with GrantHelper
SBCRS objectives and outcomes
The objectives of the program are:
- build the cyber resilience and capability of small businesses
- provide support to small businesses impacted by a cyber incident
The intended outcomes of the program are to improve the cyber security of small businesses and their ability to recover from a cyber incident.
Activities eligible for SBCRS support
Eligible activities must directly relate to the project and must include all of the following:
- undertake an individual assessment of a small business’ cyber security needs
- develop a tailored plan, commensurate with the small business risk, situation and capability, providing advice and solutions that are aligned with best practice guidance available on cyber.gov.au
- assist small businesses to navigate the material and tools available to them
- refer small businesses to the health check (once available) and Cyber Wardens program
- provide advice to small businesses drawing on the tailored plan produced as part of the health check (once available)
- provide person to person support services via a helpline to deal with the impact and aftermath of an incident, including guidance on practical steps a small business can take to recover from the incident
- identify where the small business requires additional expertise to recover and facilitate appropriate referrals
- develop and maintain referral pathways to industry customer support services for small businesses
- advise small businesses of any reporting or legal obligations and provide support for them to meet these obligations
- provide advice on preventing a future attack and guidance on implementing this advice
- take referrals from cyber.gov.au
- refer small businesses to the Cyber Security Hotline (1300CYBER1) when they are experiencing a cyber incident
- report near-real time raw data back to Australian Signals Directorate (ASD) to provide visibility of types and volumes of threats facing the small business sector
- encourage small businesses to report incidents to cyber.gov.au.
Service requirements:
1. service delivery:
- deliver services in the form of direct one-on-one support, via a telephone helpline
- provide options for phone and online booking for businesses to register for the Service
- liaise with ASD to establish referral pathways and near real-time data sharing arrangements
- ensure the service is accessible independently of cyber.gov.au for example, via a standalone website.
2. staff:
- engage technical personnel who are, or will be, appropriately qualified, trained or experienced in cyber security, small business matters and counselling clients in distress.
3. data and reporting:
- monitor the quality and effectiveness of the service you provide, and the staff delivering them, through surveys of your clients’ satisfaction and analysis of call data
- provide client data so the Treasury can periodically survey your clients to gauge the quality and effectiveness of the service you provided, and your clients’ satisfaction with them
- comply with the data collection and reporting obligations of the program (see section 12), and share near real-time data with ASD.
See the guidelines for activities eligible for SBCRS support.
Expenditure eligible for SBCRS support
Eligible expenditure items include:
- labour costs of employees you directly employ on the core elements of the project. We consider a person an employee when you pay a regular salary or wage, out of which you make regular tax instalment deductions
- up to 35 per cent labour on costs to cover employer paid superannuation, payroll tax and workers compensation insurance and overheads such as office rent and the purchase or provision of computing equipment directly required or related to the delivery of the project
- contract expenditure covering the cost of eligible project activities that are contracted to others. All contractors must have a written contract prior to starting any project work. Invoices from contractors must contain a detailed description and breakdown of the work including hours and hourly rates
- domestic travel limited to the reasonable cost of accommodation and transportation required to conduct agreed project activities in Australia
- staff training that directly supports the achievement of project outcomes
- ICT costs directly relevant to the project
- job advertising and recruiting, and recruitment contract negotiations
- the cost of an independent audit of project expenditure (where we request one) up to a maximum of 1 per cent of total eligible project expenditure
- contingency costs up to a maximum of 10 per cent of the eligible project costs. Note that we make payments based on actual costs incurred.
Expenditure items that are not eligible are:
- technical advice and support provided to a small business while they are experiencing a live cyber incident
- research not directly supporting eligible activities
- activities, equipment or supplies that are already being supported through other sources
- costs incurred prior to the grant agreement being executed
- any in-kind contributions
- financing costs, including interest
- capital expenditure for the purchase of assets such as office furniture and equipment, motor vehicles, and the construction, renovation or extension of facilities such as buildings and laboratories
- computing equipment not directly required or related to the delivery of the project
- costs such as renovations and utilities
- costs associated with media campaigns, including promotional material and activities
- non-project-related staff training and development costs
- costs related to obtaining resources used on the project, including interest on loans (excluding recruitment)
- depreciation of plant and equipment beyond the life of the project
- maintenance costs.
See the guidelines for expenditure eligible for SBCRS support.
Other SBCRS important details that you will need to know
Organisations eligible for SBCRS support
To be eligible you must:
- have an Australian Business Number (ABN)
- be registered for the Goods and Services Tax (GST)
and be one of the following entities:
- an entity, incorporated in Australia
- an Aboriginal and Torres Strait Islander Corporation registered under the Corporations (Aboriginal and Torres Strait Islander) Act 2006 (Cth)
- a company limited by guarantee
- an incorporated trustee on behalf of a trust, where your trading activities:
- form a sufficiently significant proportion of the corporation’s overall activities as to merit it being described as a trading corporation; or
- are a substantial and not merely peripheral activity of the corporation
- an incorporated association
- an incorporated not for profit organisation or registered charity
- a publicly funded research organisation as defined in section 14 of the guidelines.
Joint applications are acceptable, provided you have a lead organisation who is the main driver of the project and is eligible to apply. For further information on joint applications, refer to section 7.2 of the guidelines.
Only applications accepted are where applicants provide evidence from their board (or chief executive officer or equivalent if there is no board) that the project is supported, and that applicant can complete the project and meet the costs of the project not covered by grant funding.
You are not eligible to apply if you are:
- an organisation, or your project partner is an organisation, included on the National Redress Scheme’s website on the list of ‘Institutions that have not joined or signified their intent to join the Scheme’
- an employer of 100 or more employees that has not complied with the Workplace Gender Equality Act (2012)
- an individual
- a Regional Development Australia Committee
- a co-operative
- a partnership
- an unincorporated association
- any organisation not included in section 4.1 of the guidelines
- a trust (however, an incorporated trustee may apply on behalf of a trust)
- a Commonwealth, state, territory or local government body (including government business enterprises)
- a non-corporate Commonwealth entity.
See the guidelines for full details of organisations eligible for SBCRS support.
SBCRS assessment criteria
Criteria 1: Extent to which your proposed service will improve the cyber security of small business and support impacted small businesses following a cyber incident (40 points).
- how your proposed service and delivery format mix will meet demand and improve cyber security of small business
- how your proposed service and delivery format mix will meet demand and improve post-incident support using a case management approach
- the customer journey for a small business accessing your services including how they will discover, access and participate in services, as well as how you will work to refer small businesses to other relevant services
- the reach of your services across Australia and the number of businesses that you anticipate assisting including through each service delivery format.
Criteria 2: Capability to deliver the service (40 points).
- your track record managing similar projects
- your access to personnel with the right skills and experience, including management and technical personnel who are, or will be, appropriately qualified, trained or experienced in cyber security, small business matters and counselling clients in distress
- your access to any capital equipment, technology, intellectual property, administrative systems, including record keeping practices, data collection, information sharing and reporting and required regulatory or other approvals
- your ability to comply with relevant policies and laws to ensure the privacy and security of client data
- a sound project plan to manage and monitor the project and risks.
Criteria 3: Financial capacity and governance (20 points).
- a detailed project budget broken down by financial year that identifies the costs of all key project activities/services, including the development of content, travel and end of project financial audit, and demonstrates that costs are commensurate with the level of service to be provided
- your ability to fund the running costs of your organisation external to the project and any project costs that are not covered by the grant
- how your organisation meets appropriate governance standards.
See the guidelines for full details of the assessment criteria.
How do I get the SBCRS?
Your application will be considered on its merits, based on:
- how well it meets the criteria
- how it compares to other applications
- whether it provides value with relevant money.
When assessing the extent to which the application represents value with relevant money, there will be high regard to:
- the overall objective/s of the grant opportunity
- the evidence provided to demonstrate how your project contributes to meeting those objectives
- the relative value of the grant sought.
Applicants must:
- Read and understand the guidelines.
- Ensure eligibility for the funding. Applicants that do not meet all the eligibility criteria will not be considered.
- Deliver the project as outlined in the application.
- Provide complete information requirements.
Information to prepare for the SBCRS application
Prepare the following information/documents:
- a project plan to manage and monitor the project and identify potential risks
- a detailed project budget broken down by financial year that identifies the costs of all key project activities/services, including the development of content, travel and end of project financial audit, and demonstrates that costs are commensurate with the level of service to be provided
- evidence of support from the board, CEO or equivalent (template provided on business.gov.au and GrantConnect). Where the CEO or equivalent submits the application, we will accept this as evidence of support
- trust deed (where applicable)
- letters of support in case of joint applications (where applicable).
See the guidelines for full details of information requirements.
Applying for the SBCRS
Applications are submitted online through the business.gov.au portal.
Register your interest here with GrantHelper to explore your alignment with this grant and how we can assist you to increase your chances of success.
SBCRS resources
Key documents are found on the GrantConnect website. By registering on this website, you will be automatically notified of any changes. GrantConnect is the authoritative source for grants information.
I need help applying for grants
Our Insights showcase some of the grant-winning methods we employ at GrantHelper, and they will help you create a stronger grant application. But no matter how well prepared you are, winning grants takes time—something we know many business owners and directors just don’t have. And that’s why we’re here to help.
- Check out our How to Prepare Before You Apply insight to help you reduce the stress levels when you apply for a grant.
- Check out How to write a successful grant application to learn some time-saving tips to make the grant writing process easier.
GrantHelper can assist with your organisation’s next grant application, no matter what stage of the funding journey you’re at.
Our in-depth eBook is the single most valuable resource you will find that helps organisations to truly understand how to win government grants.
Download our eBook to discover grant-winning secrets
Our free eBook features 10 chapters of expert advice, professional tips and more to help you do better with grants, whether you’re new to the process or you’ve applied before.
Get your copy of the Guide to Winning Grants now.
Is your business eligible for this government grant?
Or perhaps you’re not sure and want to know more?
GrantHelper offers a range of government grant services, helping businesses of all sizes to discover, apply for, and win the best grant opportunities. We can help you with anything from finding the right grants, to writing your application, formulating an ongoing grant strategy, and more.
Get started now by filling in the form below, or tap the ‘Book a Discovery Call’ button to schedule a no-obligation virtual meeting with an experienced government grants consultant.
Prefer to talk? Call 0409 478 850 now for a no-obligation discussion. We’re here to help your business better understand grants, submit your best possible application, and get you in the winners’ circle.
Check out some of the clients we’ve helped and what they had to say about us.
