The Essential Eight comes up whenever cyber security is discussed in Australia, in insurance forms, client questionnaires and IT proposals. For a small business owner, the useful questions are simple. What is it, which parts matter for a business your size, and where should you start?
This guide explains the Essential Eight in plain English, with links to our more detailed guide on each strategy.
What is the Essential Eight?
The Essential Eight is a set of eight security strategies published by the Australian Signals Directorate (ASD), the agency behind the Australian Cyber Security Centre. ASD describes them as a baseline that makes it much harder for attackers to get into a business’s computers and systems, and easier to recover if they do.
It is mandatory for many federal government agencies, but not for private businesses. ASD notes there is no requirement for businesses to have their Essential Eight work certified, unless a regulator, a government directive or a contract asks for an assessment. For most small businesses, it is a practical checklist rather than a legal obligation.
The current version of the Essential Eight Maturity Model dates from November 2023. In mid 2026, ASD consulted on how the Essential Eight will evolve, so it is worth checking for changes over the next year.
The eight strategies in plain English
Stopping attacks from running
- Application control lets only approved programs run on your computers, so a malicious file a staff member downloads cannot simply start. Read our guide to application control.
- Restrict Microsoft Office macros blocks the small programs inside Word and Excel files that attackers use to deliver malware, unless they come from a trusted source. Read our guide to macro settings.
- User application hardening switches off features in web browsers and other everyday software that attackers commonly misuse, such as unwanted ads and old plug-ins. Read our guide to user application hardening.
- Patch applications keeps software such as browsers, Microsoft Office and PDF readers updated, closing the security holes attackers rely on. Read our guide to patching applications.
Limiting the damage if someone gets in
- Restrict administrative privileges means staff work on everyday accounts, with administrator access kept for the few people and tasks that need it. Read our guide to restricting administrative privileges.
- Patch operating systems keeps Windows, macOS and server software updated, and replaces systems that no longer receive updates. Read our guide to patching operating systems.
- Multi-factor authentication asks for a second check, such as an app on your phone, so a stolen password alone is not enough to get into an account. Read our guide to multi-factor authentication.
Recovering when something goes wrong
- Regular backups keep copies of your data, software and settings that are stored securely and tested, so you can recover after a failure or an attack. Read our guides to reliable backups and backing up Microsoft 365.
How the maturity levels work
Each strategy can be put in place at one of four maturity levels, from zero to three. Maturity Level Zero means there are weaknesses in that area. Maturity Level One protects against opportunistic attacks using widely available tools and stolen or guessed passwords, while Levels Two and Three protect against more determined and capable attackers.
ASD suggests choosing one target level and reaching it across all eight strategies before moving any of them higher. Its guidance says Maturity Level One may be suitable for small to medium businesses, with higher levels aimed at larger organisations and critical infrastructure.
What Maturity Level One looks like in practice
Maturity Level One is more specific than many people expect. Patching is a good example. At Level One, ASD expects:
- Security updates for internet-facing services to be applied within 48 hours if the issue is critical or being actively exploited, and within two weeks otherwise
- Updates for Microsoft Office, web browsers, email software, PDF readers and security software to be applied within two weeks
- Updates for the operating systems on staff computers to be applied within one month
- Software and systems that no longer receive updates to be removed or replaced
The other strategies have similar detail, such as multi-factor authentication for staff signing in to online services and email, and backups that ordinary user accounts cannot change or delete. That level of detail is why most small businesses work through the Essential Eight with their IT provider rather than on their own.
Where should a small business start?
ASD’s own small business cyber security handbook starts with three steps: turn on multi-factor authentication, keep software up to date and back up your data regularly. Those three steps line up with three of the eight strategies, and they are where ASD suggests small businesses begin.
It is worth getting these right. In ASD’s Annual Cyber Threat Report 2024-25, the average self-reported cost of a cybercrime for a small business was $56,600.
From there, a sensible order for most small businesses is to restrict administrator access, tighten Office macro and browser settings, and then put application control in place. If your business uses Microsoft 365, many of these controls can be set up with tools that come with it. Business Premium includes device management and protection that cover several of the eight strategies, and our guide to which Microsoft 365 plan a small business needs explains the difference between the plans.
How Digitek helps
Digitek IT helps small businesses put the Essential Eight in place in a practical order, starting with multi-factor authentication, patching and backups. Our IT Security Review looks at where your business stands today and gives you a written list of priorities, so you know what to fix first.
Find out more about our cyber security services, or call 02 4504 8643 to talk about the Essential Eight for your business.
