What Is the Essential Eight? A Plain-English Cyber Security Guide for Australian SMEs

Cyber security can sound complicated when you're running a business. You might hear about ransomware, phishing, multi-factor authentication and security frameworks, but where should you start? Australia's Essential Eight offers a practical way to prioritise important protections.

Developed by the Australian Signals Directorate (ASD), the Essential Eight is a set of eight mitigation strategies designed to make it harder for attackers to compromise internet-connected IT systems. For Australian small and medium-sized enterprises (SMEs), it provides a useful roadmap for improving security without getting lost in technical jargon.

This guide explains the eight strategies in everyday language, how maturity levels work, what business owners should ask their IT provider, and how to create a realistic improvement plan.

What exactly is the Essential Eight?

The Essential Eight is a collection of eight cyber security practices identified by ASD as particularly effective at reducing common cyber threats. The strategies address three broad goals: prevent attacks, limit what attackers can do, and recover when something goes wrong.

It is not a product you buy or a certificate you automatically receive. It is a set of technical and operational controls that must be implemented, maintained and assessed in your own environment.

The eight strategies explained in plain English

1. Application control — only allow trusted software to run

Application control helps stop unapproved or malicious programs from running on company devices. Instead of allowing any downloaded software to execute, the business defines what is permitted.

Business example: An employee downloads a fake invoice program. Application control may prevent that unapproved software from launching.

Ask your IT provider: Do we control which applications and scripts can run on our computers and servers?

2. Patch applications — keep business software up to date

Attackers often exploit known weaknesses in browsers, PDF readers, productivity software and other applications. Patching means installing vendor security updates promptly, based on risk and the applicable maturity requirements.

Business example: A vulnerable browser extension is identified and updated before attackers can use it to gain access.

Ask: Which applications are inventoried, checked for vulnerabilities and updated? How do we handle unsupported software?

3. Configure Microsoft Office macro settings — reduce risky document automation

Macros can automate legitimate tasks in Office documents, but attackers have also used malicious macros to deliver malware. This strategy restricts macro execution and how macro settings can be changed.

Business example: A suspicious spreadsheet arrives by email and tries to run harmful code. Appropriate macro restrictions help block it.

Ask: Are macros restricted according to our business needs, and can staff bypass those settings?

4. User application hardening — switch off unnecessary risky features

Some application features make attacks easier when left enabled unnecessarily. Hardening means configuring browsers, document readers and other software to reduce the opportunities available to attackers.

Business example: A browser is configured to limit dangerous or unneeded functionality rather than relying on its default settings.

Ask: Do we apply and regularly review secure application configurations?

5. Restrict administrative privileges — limit powerful access

Administrator accounts can install software, change settings and access sensitive systems. If attackers compromise one, the damage can be serious. This strategy limits privileged access to people and tasks that genuinely need it.

Business example: Staff use standard accounts for everyday work and separate, tightly controlled administrator accounts for approved IT changes.

Ask: Who has administrator rights, why do they need them, and when were those rights last reviewed?

6. Patch operating systems — keep Windows and other systems supported

Operating systems also contain vulnerabilities. Applying security updates and replacing unsupported operating systems reduces the number of known weaknesses attackers can exploit.

Business example: An ageing workstation running an unsupported operating system is upgraded or replaced as part of a planned refresh.

Ask: Do we have a complete device inventory, patch reporting and a plan for unsupported systems?

7. Multi-factor authentication (MFA) — add another layer to sign-ins

MFA requires additional proof of identity beyond a password. It helps protect accounts when passwords are stolen, guessed or reused. The exact authentication methods and coverage needed depend on the maturity level and system.

Business example: A criminal obtains an employee's Microsoft 365 password but cannot complete the sign-in without the required additional authentication.

Ask: Is MFA enforced for the relevant users, privileged accounts, cloud services and remote access? Are we using stronger phishing-resistant methods where appropriate?

8. Regular backups — be able to recover critical data

Backups help businesses recover from ransomware, accidental deletion, equipment failure and other incidents. The important questions are what is backed up, how protected the backups are, and whether restoration actually works.

Business example: A file server is compromised, but the business can restore clean data from protected backups that have been tested.

Ask: Are our backups protected from unauthorised changes and deletion, monitored, and tested through actual recovery exercises?

Learn more about ITNetFix backup and recovery services.

Essential Eight maturity levels: what do Levels 0, 1, 2 and 3 mean?

ASD's Essential Eight Maturity Model describes four levels. They are not simply a score out of three; each target level has detailed requirements across all eight strategies.

ASD guidance notes that Maturity Level 1 may generally suit many SMEs, but your target should reflect your risks, contractual obligations, industry and technology environment. A business handling highly sensitive information may need a higher target or additional controls.

It is also important not to claim overall Level 1 or Level 2 maturity because just one or two controls are in place. A proper assessment considers the requirements across the applicable strategies and scope.

Why should Australian small businesses care?

SMEs may have limited IT resources, but they still depend on email, cloud applications, customer data, banking, devices and reliable networks. A single compromised account or failed backup can interrupt operations and create expensive recovery work.

• Reduce avoidable disruption: Updates, access restrictions and application controls help reduce exposure to common attacks.
• Protect business information: MFA, privilege controls and backups help safeguard important systems and data.
• Improve accountability: The framework creates clearer questions for business owners and IT providers.
• Support customer and insurer discussions: Documented security controls may help when responding to security questionnaires, although the Essential Eight does not guarantee insurance acceptance or compliance.
• Plan IT investment: A gap assessment helps prioritise practical improvements rather than purchasing tools without a plan.

How to start implementing the Essential Eight: a practical SME roadmap

Step 1: Understand what you have

List business devices, servers, applications, Microsoft 365 services, important data and people with privileged access. You cannot reliably secure or patch systems you do not know about.

Step 2: Identify existing controls and gaps

Review whether MFA is enforced, operating systems and applications are supported, backups are recoverable, and privileged accounts are controlled. Use the official maturity model rather than assuming that having a product installed means a requirement is met.

Step 3: Choose an appropriate target

Consider your business risk, customer expectations, contracts and budget. Many SMEs can use Level 1 as an initial planning target, but a documented risk assessment should guide the decision.

Step 4: Prioritise urgent weaknesses

Address high-risk exposures promptly—for example, unsupported internet-facing systems, missing MFA on important accounts or backups that cannot be restored. Work toward the full target maturity level rather than treating these first actions as complete compliance.

Step 5: Assign owners and document evidence

Record who manages patching, access, application settings, backups and testing. Keep evidence such as configuration reports, asset inventories, access reviews, patch status and backup restore-test records.

Step 6: Reassess regularly

Security changes as people join or leave, devices are replaced, new applications are introduced and threats evolve. Schedule ongoing checks and reassess after significant technology changes.

Essential Eight and Microsoft 365: is enabling MFA enough?

No. Microsoft 365 can help support identity security, device management and access controls, but enabling MFA alone does not implement the entire Essential Eight. Businesses still need to consider devices, operating systems, applications, administrator access, macro settings, backups and other requirements.

For Microsoft 365 environments, useful starting questions include whether MFA is enforced, privileged accounts are separated and protected, user offboarding is reliable, and cloud data recovery responsibilities are understood. See ITNetFix Microsoft 365 support and business cybersecurity services.

Common Essential Eight mistakes to avoid

• Confusing a tool with a control: Buying antivirus or device management software does not prove that every relevant requirement is implemented.
• Ignoring old systems: Unsupported software can undermine otherwise good security practices.
• Protecting only some accounts: Important administrative and cloud accounts need appropriate authentication and access controls.
• Assuming backups work: Successful backup jobs are not a substitute for restore testing.
• Declaring a maturity level without assessment: Use the ASD assessment guidance and retain evidence of what has been checked.
• Treating the Essential Eight as the whole security program: Incident response, awareness, third-party risks and other safeguards may still be necessary.

Does every Australian business legally need to comply with the Essential Eight?

There is no single blanket rule requiring every private Australian SME to achieve an Essential Eight maturity level. However, government directions, industry requirements, customer contracts or procurement conditions may require particular controls or assessments. Seek advice about obligations specific to your business rather than assuming the same rule applies to every organisation.

Frequently asked questions

Who created the Essential Eight?

The Australian Signals Directorate (ASD) developed the Essential Eight as part of its guidance on mitigating cyber security incidents. The Australian Cyber Security Centre (ACSC) publishes the official guidance on cyber.gov.au.

Is the Essential Eight the same as ISO 27001?

No. The Essential Eight focuses on eight prioritised technical mitigation strategies. ISO/IEC 27001 is a broader information security management system standard. They can complement each other but are not interchangeable.

Is Essential Eight certification mandatory?

ASD does not require all organisations to obtain independent Essential Eight certification. Independent assessment may be required by a specific regulator, directive or contract. Be cautious of marketing claims suggesting there is a universal government-issued Essential Eight certificate.

How long does implementation take?

It depends on the number of devices, legacy systems, existing controls, staff resources and target maturity. A small business with modern, centrally managed systems may have a simpler path than an organisation with ageing servers and specialist applications.

Can an MSP help with the Essential Eight?

Yes. An MSP can assist with asset inventories, patch management, MFA, device configuration, privilege reviews, backups, reporting and a remediation plan. However, the organisation remains responsible for understanding its risks and verifying the agreed scope of work.

Official Australian Government resources

For detailed requirements and assessment methods, use ASD's official Essential Eight explained, Essential Eight Maturity Model, and assessment process guide. Requirements can change, so check the latest official version before making compliance or maturity claims.

Final thoughts: start with a plan, not a shopping list

The Essential Eight gives Australian SMEs a sensible way to discuss cyber security priorities. The best first step is to understand your current environment, identify real gaps, select an appropriate target and make steady improvements supported by evidence.

If your business needs help with cybersecurity, Microsoft 365, network security, device management or backups, explore IT support in Sydney and managed IT support packages.