Essential Eight Cybersecurity Guide

Why a framework built for government matters to a 20-person business

The Essential Eight is a set of mitigation strategies published by the Australian Cyber Security Centre (ACSC). It exists because analysis of real incidents kept showing the same thing: a small number of controls prevent the large majority of common attacks. SMEs are attractive targets precisely because attackers assume — usually correctly — that these basics aren't in place. Ransomware crews and invoice-fraud operators don't hand-pick victims; they scan for whoever is easiest. The Essential Eight is about not being the easiest.

It's also increasingly commercial: larger customers, insurers and government buyers ask suppliers about Essential Eight alignment. Being able to answer credibly is becoming a tendering asset.

The eight strategies, in plain English

• Patch applications. Update the software you run — browsers, office suites, PDF readers, business apps — promptly, prioritising fixes for vulnerabilities attackers are actively exploiting. Most successful attacks exploit holes that patches already existed for.
• Patch operating systems. The same discipline for Windows, macOS and your servers. Turn automatic updates on wherever the business can tolerate it.
• Multi-factor authentication (MFA). A second factor on email, accounting software, remote access and anything internet-facing. The single highest-value control on this list for most SMEs — it defeats the everyday password-theft attacks behind most business email compromise.
• Restrict administrative privileges. Day-to-day work happens in accounts that can't install software or change systems; admin rights live in separate accounts used only when needed. This caps the damage when (not if) an account is compromised.
• Application control. Only approved software can run on your machines. The most technical of the eight, and usually the one SMEs implement last, with help.
• Restrict Microsoft Office macros. Block macros from the internet and allow only vetted ones. Malicious macros in emailed documents remain a favourite delivery mechanism.
• User application hardening. Switch off the legacy, risky features of browsers and productivity apps that ordinary businesses never use but attackers love.
• Regular backups. Backed up, tested by actually restoring, with copies an attacker who compromises your network can't reach or encrypt. Backups are what turn ransomware from an existential event into a bad week.

Maturity levels: you don't have to do everything at once

The ACSC defines maturity levels for each strategy, from partial implementation up to hardened configurations aimed at well-resourced adversaries. The framework is explicitly designed to be climbed progressively. For a typical SME, the sensible reading is: get every strategy to a baseline before polishing any single one to a high level — a business with MFA everywhere, current patches and tested backups is dramatically harder to hurt than one with a single perfect control and seven gaps.

A pragmatic order of attack

• First: MFA on email and finance systems, automatic updates turned on, and a tested backup. High protection, low cost, achievable in days.
• Next: separate admin accounts, macro restrictions, and an inventory of what software and devices you actually have — you can't patch what you don't know about.
• Then: application control and hardening, typically with your IT provider, plus a written incident plan: who you call, how you isolate a machine, where the ACSC's reporting channels are.

Pair the technology with process: verify any change to a supplier's bank details by phoning a known number, because the most damaging SME losses are often payment redirection fraud that no patch prevents. Security controls sit alongside your other operational disciplines — the same systemising mindset covered in our operations overview — and if all of this currently depends on one tech-savvy staff member, treat that as the same risk as any other back-office capability gap.

Where to go for the authoritative detail

The ACSC publishes the Essential Eight strategies, the maturity model and current implementation guidance at cyber.gov.au, along with small-business-specific resources and the national channel for reporting cybercrime. Requirements and recommended configurations evolve as the threat landscape does, so treat the ACSC's current publications — not this page — as the source of truth when you implement.