Essential Eight for small business: where to start

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. They target the most common ways attackers get in and do damage, and they are the checklist many insurers, auditors and larger clients now ask about.

The eight strategies

• Patch applications. Keep browsers, Office, PDF readers and other apps up to date, and remove apps that are no longer supported.
• Patch operating systems. Keep Windows and macOS up to date, and replace computers that can no longer get updates.
• Multi-factor authentication. Require a second step to sign in, starting with email, remote access and anything that can move money.
• Restrict administrative privileges. Staff work in normal accounts; admin accounts are separate and only used when needed.
• Application control. Only approved programs can run on business computers.
• Restrict Microsoft Office macros. Block macros from the internet and only allow the ones your business actually needs.
• User application hardening. Turn off the browser and Office features attackers abuse.
• Regular backups. Back up important data, keep copies separate from your everyday accounts, and test that you can restore them.

What the maturity levels mean

The Essential Eight maturity model has four levels, from Maturity Level Zero to Maturity Level Three. Level One is aimed at opportunistic attackers using widely available tools, Level Two at attackers willing to put in more time and effort, and Level Three at more capable, targeted attackers. You only reach a level when all eight strategies meet it.

ASD suggests choosing a target level that suits your risk and reaching it across all eight strategies before aiming higher. For most small businesses, Level One is the first goal, and Level Two is a sensible target if you hold sensitive client, patient or financial information.

The current maturity model was published in November 2023. ASD has also consulted on growing the Essential Eight into a broader “Essentials” series, so expect changes over the next few years. The eight strategies themselves remain a solid foundation.

Where to start: a practical order

1. Multi-factor sign-in everywhere. The biggest single step for most businesses, and usually quick to switch on in Microsoft 365.
2. Backups you have tested. Including Microsoft 365, kept separate from your normal accounts.
3. Patching on a schedule. Automatic updates for Windows, macOS and common apps, with someone checking they actually install.
4. Remove admin rights from everyday accounts. It limits what one bad click can do.
5. Lock down macros and harden apps. Mostly settings in Microsoft 365 and your browsers.
6. Application control. The most involved strategy, and much easier once the others are in place.

Do you have to do this?

For most private businesses the Essential Eight isn’t a legal requirement, but it is increasingly expected. Federal government agencies are required to implement it, cyber insurers ask about it, and larger customers often ask their suppliers where they stand. Knowing your current level also turns a vague worry into a short, prioritised list.

Book a free Essential Eight check and we’ll tell you where you stand and what to fix first.