The Essential Eight explained for Australian small businesses

If a client, insurer or tender has asked whether your business "aligns with the Essential Eight", you're not alone. It's become the standard checklist for cybersecurity in Australia, and it's far less scary than it sounds.

What is the Essential Eight?

The Essential Eight is a set of eight security strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate. Together they make it much harder for attackers to break in, and much easier to recover if something does go wrong.

They're designed for Microsoft Windows-based networks, which describes most Australian offices.

The eight strategies, in plain English

Patch applications: keep software like web browsers, PDF readers and Microsoft Office up to date.
Patch operating systems: keep Windows and macOS updated, and replace computers that no longer get security updates.
Multi-factor authentication (MFA): require a second step, like an app code, to log in to email and important systems.
Restrict administrative privileges: staff shouldn't use "admin" accounts for everyday work.
Application control: only allow approved programs to run on work computers.
Restrict Microsoft Office macros: block macros from the internet, a common way attacks get in through email attachments.
User application hardening: turn off risky browser and app features that attackers abuse.
Regular backups: back up important data, keep a copy separate from your network, and test that you can restore it.

What are the maturity levels?

Each strategy can be implemented at Maturity Level One, Two or Three, depending on how strict the controls are. Level Zero means a strategy isn't really in place yet.

For most small businesses, Maturity Level One across all eight is a sensible first goal. Higher levels are usually for businesses handling sensitive data or working with government.

Where should a small business start?

If you only do three things this month, make them these:

Turn on MFA everywhere, starting with email. Email is the key to resetting every other password.
Set up automatic backups of email and files, and test a restore.
Turn on automatic updates for Windows, Mac and your browsers.

These three steps alone protect against many of the attacks that hit small businesses, like stolen passwords, ransomware and fake invoice scams.

Common mistakes we see

Sharing one login between staff, so there's no way to tell who did what.
Everyone has admin rights "because it's easier".
Backups that have never been tested, or that sit on a drive plugged in next to the computer.
Old computers still running unsupported versions of Windows.

Useful free resources

The ACSC's guidance for small businesses at cyber.gov.au.
If you've been hacked or scammed, report it via ReportCyber on cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

How Mateware can help

We run fixed-price Essential Eight assessments that show exactly where your business stands and what to fix first, from $1,490. Our Secure+ IT plan keeps you aligned month to month. See our IT & security plans, or book a free chat.