Most Australian business owners have heard of the Essential Eight by now. Fewer know where their business stands. If you’re running a small or medium business in Perth or Western Australia, there’s a good chance your cybersecurity practices are somewhere between "not quite right" and "better than nothing".
The Essential Eight is a framework published by the Australian Cyber Security Centre (ACSC) - the federal agency responsible for advising Australian businesses on cyber risk. It sets out eight baseline controls designed to protect organisations against the most common attacks. It’s not just for government departments. It’s the benchmark that clients, procurement teams, and insurers are increasingly using to decide whether your business is a safe partner to work with.
What the Essential Eight actually covers
The eight controls each target a specific way attackers get into your systems. In plain English:
- Application control - only let approved software run on company devices.
- Patch applications - keep apps like browsers, PDF readers and Office up to date.
- Configure Microsoft Office macro settings - block dodgy macros hidden in Word and Excel files.
- User application hardening - lock down web browsers (block Java and web ads from the internet, and remove Internet Explorer 11).
- Restrict administrative privileges - staff shouldn’t be admins on their own laptops.
- Patch operating systems - keep Windows, macOS and servers up to date.
- Multi-factor authentication (MFA) - a second step (usually an app on your phone) to prove it’s really you logging in.
- Regular backups - daily, off-site, and restorable.
Think of them as layers. No single layer is foolproof. But together, they make it significantly harder for attackers to succeed - and much easier to recover if something does go wrong.
The framework uses a maturity model with four levels, and each level is defined by the kind of attacker it is meant to stop. Maturity Level Zero means there are gaps an attacker could use. Level One is aimed at opportunistic attackers using widely available tools and techniques. Level Two is aimed at attackers who put more effort into a specific target. Level Three is aimed at skilled, adaptive attackers who don’t rely on public tools. For most small businesses, Level One across all eight controls is the realistic and valuable target.
A practical readiness self-check
Before engaging a consultant or running a formal audit, it’s worth doing a quick honest assessment of where your business currently sits. Work through these questions:
- MFA: Do all staff use multi-factor authentication to access email, file storage, and any cloud applications? If the answer is "most of them" or "the technical staff do," you’re not at Level One.
- Patching: Are browser, Office and PDF reader updates applied within two weeks of release, and operating system updates within a month? If staff are dismissing update prompts or you’re running software that’s no longer supported, you have a patching gap.
- Backups: Are backups running daily, stored in multiple locations including offsite or cloud, and have you restored from them? A backup you’ve never restored from is a backup you can’t trust.
- Admin privileges: Do your staff use standard (non-admin) accounts for their day-to-day work? Giving everyone admin rights because it’s convenient is one of the most common security mistakes in small businesses.
- Macros: Are Microsoft Office macros blocked by default, with only approved macros permitted to run? Malicious macros embedded in documents are a common malware delivery method.
If you answered "no" or "I’m not sure" to any of these, your business has meaningful gaps in its Essential Eight posture - and those gaps represent real risk.
Why this matters now
The Essential Eight is designed to mitigate the techniques behind most common attacks: stolen passwords, malicious email attachments and unpatched software. ASD’s Annual Cyber Threat Report tracks how those attacks affect Australian businesses, and smaller businesses are squarely in scope, because attackers know they often have weaker controls than large enterprises.
Beyond the threat itself, there are commercial consequences to consider. If your business works with local government, large construction or engineering firms, healthcare organisations, or any entity that handles sensitive data, you may already be facing contractual or procurement requirements around cybersecurity. The Essential Eight is increasingly the standard these organisations reference.
That makes cybersecurity a commercial risk the owner needs to manage.
Where to start if you’re behind
You don’t need to fix everything at once. Start with the three controls that deliver the most impact for the least effort:
- Enable MFA everywhere. If you’re using Microsoft 365, you can do this today at no extra cost. It blocks the overwhelming majority of account takeover attacks.
- Fix your backups. Ensure backups run daily, are stored in at least two locations (one of which is offsite or cloud), and that you can restore from them. Document your recovery process so you know it works before you need it.
- Get your patching under control. Automate operating system updates where possible. Create a schedule for reviewing and applying application updates. A managed IT provider can handle this as part of ongoing services.
Once those three are solid, work through the remaining five strategies. Each one builds on the last.
Getting a formal assessment
If you want a clear, objective picture of where your business sits against the Essential Eight, our Essential Eight assessment is the right starting point. This gives you a current-state baseline, a gap analysis, and a prioritised roadmap - without the jargon or the pressure to buy something immediately.
The goal isn’t perfection. It’s getting to a posture where your business is materially harder to attack than the average target, where a successful attack causes less damage, and where you can recover faster if the worst happens. That’s what the Essential Eight is designed to deliver - and it’s achievable for businesses of any size.