The Essential Eight, explained for business owners

If you run a business in Australia, you've probably had the "Essential Eight" mentioned by your insurer, your accountant, or an IT person - usually followed by a lot of acronyms. Here's the honest, jargon-free version.

The Essential Eight is a set of eight security measures published by the Australian Cyber Security Centre (ACSC) - part of the federal government. Think of it as a checklist of the eight most effective things a business can do to avoid the most common cyber attacks. It isn’t a law, and it isn’t the whole story of security. But it is the closest thing Australia has to a national baseline, and it’s quickly becoming what insurers and larger clients expect you to meet.

Why it exists

Most cyber incidents that hit small and medium businesses aren’t the work of criminal masterminds. They’re opportunistic. Someone clicks a dodgy attachment, a password gets reused, a server goes unpatched for a year. The Essential Eight targets exactly these everyday failures - the unlocked doors, not the master burglars.

The eight, in plain English

Officially they’re grouped into three goals: prevent attacks, limit the damage, and recover your data. Here’s what each one actually means for you:

• Application control - only approved programs can run, so malware can’t just launch itself.
• Patch applications - keep everyday software (browsers, PDF readers) up to date, fast.
• Configure Office macros - block the hidden code in dodgy Word and Excel attachments.
• User application hardening - switch off risky old features in browsers and apps.
• Restrict admin privileges - the fewer people with “master keys”, the safer.
• Patch operating systems - keep Windows and your servers current and supported.
• Multi-factor authentication - a second check at login, so a stolen password isn’t enough.
• Regular backups - backed up often, and actually tested, so you can recover.

Maturity levels: it’s a dial, not a switch

You don’t simply “pass” the Essential Eight. Each control has maturity levels from 0 to 3:

• Level 0 - not really doing it.
• Level 1 - the basics are in place.
• Level 2 - done consistently and managed.
• Level 3 - done, monitored, and hard for an attacker to work around.

For most small businesses, getting every control to a solid Level 1 - and the important ones to Level 2 - is a realistic, worthwhile target. You don’t need to be a defence contractor.

The 20-second gut check

Is multi-factor authentication on for everyone’s email? Do you have backups you’ve actually restored from in the last few months? If either answer is “no” or “not sure”, you’ve found your starting point - and you’re far from alone.

Why business owners should care now

Three reasons it’s moved from “IT’s problem” to “the owner’s problem”:

• Insurance. Cyber insurers increasingly ask about these controls at renewal, and can reduce or refuse a payout if you claimed protections you didn’t have.
• Contracts. Government and larger private clients are starting to require Essential Eight alignment from their suppliers.
• Reality. A single ransomware incident can mean days of downtime and a five-figure recovery bill. The Essential Eight is simply the cheapest insurance against that.

How we approach it

At First Assist, we align every managed plan with all eight strategies as standard - not as an expensive add-on. We track where you stand, close the gaps quietly in the background, and keep you informed in plain English. And if you ever need a formal, independent Essential Eight audit or certification - for a contract or an insurer - we arrange that through trusted specialist partners. Since 1998, that’s been our whole idea of good IT: security should be built in, like seatbelts.