CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, PCI-DSS, SMB1001
Why retailers and online stores are targeted
Online stores are targeted by "skimming": malicious code slipped into a checkout page, often through an outdated plugin or theme, that copies card details as customers type them. The store keeps trading normally, so it can go unnoticed for weeks.
Physical stores face compromised point-of-sale systems and payment terminals on the same network as guest Wi-Fi. Both kinds of business hold customer accounts, order histories and marketing lists that are valuable to scammers.
What the retail & ecommerce check asks about
The quick check has 20 questions and the full assessment 44. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- PCI-DSS — cardholder data
- eCommerce platform security
- POS & terminal security
- Customer data & Privacy Act
- Online fraud controls
- Third-party & supply-chain
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- PCI DSS. Every business that accepts card payments must meet the Payment Card Industry Data Security Standard for the way it takes them. Version 4.0's newer requirements, including controls over scripts on payment pages, became mandatory on 31 March 2025. See our PCI-DSS guide.
- The Privacy Act. Retailers with annual turnover above $3 million, and any business that trades in personal information, must comply with the Australian Privacy Principles and the Notifiable Data Breaches scheme.
- Ransomware payments. Businesses with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Keep your store platform, plugins and themes up to date, and remove the ones you no longer use
- Turn on multi-factor authentication for your store admin, payment gateway and email
- Put POS and payment terminals on a network separate from guest Wi-Fi
- Only keep the customer data you actually need
Start the free retail & ecommerce check
Frequently asked questions
Does a small online store need to be PCI compliant?
Yes. PCI DSS applies to every business that accepts card payments. Using a hosted payment page from a reputable gateway greatly reduces what you are responsible for, but you still need to complete the self-assessment that applies to you.
What is Magecart or web skimming?
It is malicious code added to an online checkout that copies card details as customers type them. It usually gets in through an outdated plugin, theme or third-party script, which is why keeping your store updated and limiting scripts on payment pages matters.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a PCI assessment, formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.