Essential Eight for small business
Essential Eight for Small Business: A Plain-English Australian Guide
The Essential Eight is a set of cybersecurity mitigation strategies developed by the Australian Signals Directorate. This guide explains what each control means for an Australian small business, how maturity levels work and where to begin.
- Eight coordinated mitigation strategies
- Four maturity positions, including Level Zero
- Evidence matters as much as configuration
- Not a certification by itself
- Target maturity should reflect risk and requirements
- Regular reassessment is important
Essential Eight explained
A practical framework for reducing common cyber risks.
For a small business, the Essential Eight provides a practical way to prioritise patching, access controls, application security and recoverability. The Essential Eight focuses on strategies that make it more difficult for attackers to compromise systems and that improve an organisation’s ability to recover. It is maintained by the Australian Signals Directorate through the Australian Cyber Security Centre.
The framework is more than a checklist. The strategies should be implemented as a coordinated set because weaknesses in one area can reduce the protection provided by another.
Why it exists
Many incidents use known vulnerabilities, stolen credentials, excessive privileges or weak recovery arrangements. The Essential Eight addresses these common pathways.
What it does not do
It does not eliminate cyber risk, replace every security control or automatically certify an organisation as compliant.
The eight mitigation strategies
Official controls explained in practical terms.
The descriptions below are simplified. Implementation requirements vary by maturity level and should be checked against the current official model.
Application control
Purpose
Prevent unapproved applications, scripts and installers from executing.
Simple example
Only software authorised for a person’s role is allowed to run.
Common gap
Relying on antivirus alone or applying controls inconsistently across devices.
Patch applications
Purpose
Address known vulnerabilities in applications within appropriate timeframes.
Simple example
Browsers, productivity tools and internet-facing applications are monitored and updated.
Common gap
Assuming every application updates automatically or overlooking unsupported software.
Restrict Microsoft Office macros
Purpose
Reduce the risk of malicious macro code running through Microsoft Office files.
Simple example
Macros from files obtained from the internet are blocked and trusted use is controlled.
Common gap
Allowing broad macro use because one team relies on a small number of legitimate files.
User application hardening
Purpose
Restrict application features and settings that are commonly abused by attackers.
Simple example
Web browsers and document viewers are configured to reduce risky or unnecessary functionality.
Common gap
Using default settings without reviewing exposed features or unsupported applications.
Restrict administrative privileges
Purpose
Limit powerful access and reduce the impact of a compromised privileged account.
Simple example
People use separate administrator accounts only for approved administrative tasks.
Common gap
Permanent local administrator rights, shared privileged accounts or weak access reviews.
Patch operating systems
Purpose
Address known vulnerabilities in supported operating systems within appropriate timeframes.
Simple example
Workstations, servers and relevant devices are inventoried, monitored and updated.
Common gap
Unsupported systems, unmanaged devices or incomplete visibility across the environment.
Multi-factor authentication
Purpose
Require more than a password for access to important systems and accounts.
Simple example
Relevant cloud, remote-access and privileged accounts use an approved additional factor.
Common gap
Protecting ordinary users while leaving some administrative, legacy or remote access outside MFA.
Regular backups
Purpose
Maintain protected backups and the ability to restore important data, software and settings.
Simple example
Backups are protected from unauthorised changes and recovery is tested.
Common gap
Having backup jobs without clear coverage, protection, ownership or restoration evidence.
Coordinated protection
The strategies support each other.
Strong implementation in one area does not remove the need for the others.
MFA and privileged access
MFA can reduce account-compromise risk, while privilege restrictions limit what a compromised account can do.
Patching and application control
Patching addresses known vulnerabilities, while application control helps restrict unapproved execution.
Prevention and recovery
Preventive controls reduce the likelihood of compromise, while protected and tested backups support recovery.
Technology and evidence
A configuration may exist, but readiness also depends on scope, consistency, ownership, monitoring and supporting evidence.
Maturity model
Four positions describe increasing resilience.
The appropriate target should reflect the organisation’s threat exposure, information, contractual requirements and risk decisions.
Maturity Level Zero
Weaknesses exist in the organisation’s implementation of the strategies, allowing common attack techniques to succeed.
Maturity Level One
Controls are intended to protect against broadly used attack techniques and opportunistic adversaries.
Maturity Level Two
Controls are strengthened to address more capable adversaries and targeted techniques.
Maturity Level Three
Controls are further strengthened against more sophisticated and adaptive adversaries.
Requirements
Is the Essential Eight mandatory?
Whether the Essential Eight is required depends on jurisdiction, sector, contracts, customers, procurement obligations and internal policy. Some organisations adopt it voluntarily as a practical security baseline, while others face explicit requirements.
Obtain qualified advice about legal, regulatory and contractual obligations that apply to your organisation. Cybersecurity readiness guidance is not a substitute for legal advice or formal assurance.
| Situation | Why the Essential Eight may arise |
|---|---|
| Government or enterprise procurement | A tender, contract or supplier requirement may specify alignment or evidence. |
| Customer security review | A customer may ask how relevant controls are implemented and demonstrated. |
| Cyber insurance | Some questionnaire topics overlap with MFA, patching, privileges and backups. |
| Internal risk management | Leadership may adopt the model as a structured improvement target. |
Common misconceptions
Implementation is more than checking eight boxes.
“We have MFA, so we reached Level One.”
Maturity considers detailed requirements across all eight strategies and the relevant scope.
“Antivirus is application control.”
Antivirus and application control serve different purposes. One does not automatically satisfy the other.
“Automatic updates solve patching.”
Readiness also involves visibility, supported systems, prioritisation, timeframes and evidence.
“Cloud backups automatically qualify.”
Coverage, protection, retention, access and tested recovery remain important.
“The Essential Eight is a certification.”
The maturity model is an assessment framework. It is not automatically a certification or government accreditation.
“We can implement only the easiest strategies.”
The strategies are designed to work together. Selective implementation can leave important attack paths open.
Readiness checklist
Questions to begin an internal review.
This checklist is a starting point only. It does not determine a maturity level.
- Is MFA consistently applied to relevant accounts and systems?
- Are privileged accounts separate, limited and regularly reviewed?
- Are applications inventoried, supported and patched?
- Are operating systems inventoried, supported and patched?
- Are Microsoft Office macros appropriately restricted?
- Are user-facing applications securely configured?
- Is application execution controlled across the agreed environment?
- Are backups protected, monitored and tested for recovery?
- Can each control be demonstrated with current evidence?
- Are ownership and exceptions clearly documented?
Choose the right assessment
Use a broad review or a framework-specific assessment.
Cyber Risk Health Check
Best when you need broad visibility across common business cyber risks and do not have a specific framework requirement.
Essential Eight Readiness Assessment
Best when a customer, contract, insurer or internal program specifically refers to the Essential Eight.
A self-review can identify obvious gaps. A structured assessment examines the systems and evidence included in an agreed scope, documents observations and provides a prioritised improvement roadmap.
Frequently asked questions
Essential Eight questions in plain English.
Is the Essential Eight mandatory?
Requirements depend on jurisdiction, sector, contracts, procurement obligations and internal policy. Obtain qualified advice about obligations that apply to your organisation.
Is the Essential Eight a certification?
No. It is a set of mitigation strategies with a maturity model. Formal assurance or certification claims require a clearly defined and appropriately qualified engagement.
What is Maturity Level Zero?
It indicates weaknesses in the implementation of the strategies that can allow common attack techniques to succeed.
Do all eight strategies need the same maturity level?
The model is designed as a coordinated set. Target selection and assessment should use the current official guidance and the organisation’s requirements.
Does Microsoft 365 satisfy the Essential Eight?
No product automatically satisfies the whole model. Microsoft 365 may support some controls, depending on licences, configuration, scope and operating practices.
Is MFA enough to reach Maturity Level One?
No. MFA is one of eight strategies, and detailed requirements apply within each strategy.
How often should readiness be reassessed?
Reassess after material changes and on a regular schedule appropriate to your risks and obligations. Controls, systems, people and evidence change over time.
Can CyberCrunch certify our organisation?
CyberCrunch provides readiness guidance within an agreed scope. The service page explains its boundaries and does not claim government certification or accreditation.
What evidence is normally reviewed?
Evidence may include configurations, system inventories, policies, procedures, reports, logs, test results and information supplied by technology providers.
How is the Essential Eight different from ISO 27001?
The Essential Eight focuses on specific technical mitigation strategies. ISO 27001 defines requirements for an information security management system. Their purpose and assessment approaches differ.
Sources and review
Use the current official guidance.
Primary source: Australian Signals Directorate, Essential Eight Maturity Model.
Reviewed by CyberCrunch on 14 August 2026. This article provides general cybersecurity information. It is not legal advice, certification, independent assurance or a substitute for assessment against the current official requirements.
Recommended next step
Check your current Essential Eight position
Complete the self assessment to identify evidence gaps and choose the next practical improvement.
Complete the Essential Eight self assessment