The Essential Eight for a small business

The Essential Eight is a set of eight cyber security strategies from the Australian Signals Directorate (ASD): patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. ASD says Maturity Level One may suit small to medium businesses, and most of what it asks for at that level is work a ten-person office can start this month.

ASD is an Australian government agency and wrote the Essential Eight for Australian organisations. Nothing in the strategies is tied to Australian law or systems, so a business in the United States, New Zealand, Canada or the United Kingdom can use them as a sound checklist too. Everything below comes from ASD’s pages on cyber.gov.au as they read in November 2026. It is general information, not advice about your systems, so check the pages for your situation or ask whoever looks after your IT.

What the Essential Eight is

ASD publishes a longer list of defences called the Strategies to mitigate cyber security incidents. Its Essential Eight explained page says the most effective of those strategies are the Essential Eight. ASD’s FAQ describes them as a baseline that makes it much harder for attackers to break into systems, while saying no set of strategies protects against every threat.

The Essential Eight is designed to protect an organisation’s internet-connected IT network: computers, servers, cloud services and the accounts people log in with. ASD says it was not designed for fleets of mobile devices or for operational technology, such as the systems that control machinery, where other measures may suit better.

The eight strategies, and what Level One asks

Each strategy has a list of requirements at each maturity level, published in the Essential Eight maturity model. Below are the Level One requirements in plain words; the full wording is on ASD’s page.

• Patch applications. Find your devices and software automatically at least every fortnight and scan for missing updates. Apply fixes to online services within 48 hours when the vendor rates the flaw critical or a working exploit exists, and within two weeks otherwise. Update office software, web browsers and their extensions, email programs, PDF software and security products within two weeks. Remove any of these the vendor no longer supports.
• Patch operating systems. Internet-facing servers and network devices follow the same 48-hour and two-week rule. Workstations and internal servers get updates within one month of release. Replace operating systems the vendor no longer supports.
• Multi-factor authentication. Require a second factor on online services that hold your organisation’s sensitive data, on third-party services that hold it, and where available on third-party services holding less sensitive data. Services where your customers log in to sensitive data need it too. The factors must be something users have plus something they know, or something they have that opens only with something they know or are, such as a PIN or fingerprint.
• Restrict administrative privileges. Check every request for admin access when it is first made. People who need admin rights get a separate admin account used only for admin work, and that account is kept off email and web browsing unless explicitly authorised. Everyday work and admin work happen in separate environments.
• Application control. Workstations only run programs, scripts and installers from an approved set, including from user folders and temporary folders.
• Restrict Microsoft Office macros. Macros are turned off for anyone without a demonstrated business need, macros in files from the internet are blocked, macro antivirus scanning is on, and staff cannot change macro security settings.
• User application hardening. Internet Explorer 11 is disabled or removed. Web browsers do not run Java or web advertisements from the internet, and staff cannot change browser security settings. The FAQ adds that the Java rule does not include JavaScript.
• Regular backups. Back up data, applications and settings according to how critical they are to the business, in a way that lets you restore them to a common point in time. Keep backups secure and resilient, test restoring them as part of disaster recovery exercises, and make sure ordinary staff accounts cannot reach other people’s backups or change or delete any backup.

The Essential Eight maturity model in brief

The maturity model has four levels, Zero to Three. Each level above Zero is built around the kind of attacker it is meant to stop.

• Level Zero means there are weaknesses in your overall security that an attacker could use.
• Level One is aimed at opportunists using widely available tools who are looking for any victim, not you in particular. ASD’s examples are an exploit for an unpatched online service, or logging in with a password that was stolen, reused or guessed.
• Level Two is aimed at attackers who put more time into a target, including phishing for passwords and tricks to get around weak multi-factor authentication.
• Level Three is aimed at adaptive attackers who focus on particular targets and work around specific controls, for example by stealing the tokens that keep a user logged in.

The maturity model FAQ says Level One may be suitable for small to medium enterprises, Level Two for large enterprises and Level Three for critical infrastructure providers and others in high-threat environments. ASD asks organisations to reach the same level across all eight strategies before moving any of them higher, and says even Level Three will not stop an attacker willing to invest enough time, money and effort.

Does a small business have to follow the Essential Eight?

For most private businesses, no law says you must. The maturity model page says there is no requirement to have your implementation certified by an independent party. It adds that an independent assessment may be required by a government directive or policy, by a regulator, or under a contract.

Two points matter for a small business:

• Contracts. If you supply government or a large company, read your contract and any supplier security questionnaire. The FAQ notes that Level Two is a mandatory baseline for non-corporate Commonwealth entities under the Protective Security Policy Framework, and those requirements can flow through to suppliers by contract.
• Insurance is not a substitute. The FAQ says an organisation that relies on risk transference, such as cyber insurance, as its reason for skipping a whole strategy is assessed as Level Zero for that strategy and overall. Equivalent compensating controls are accepted if you can show they give the same protection.

What a ten-person office can do this month

Picture an office of ten: laptops, a shared drive, email in Microsoft 365 or Google Workspace, accounting software, a CRM and a website. Full Level One takes longer than a month, and parts of it need an IT person. This order starts with steps that need settings and decisions more than new spending.

1. Week one: list and lock. Write down every device, every online service the business logs in to and who has access to each. Turn on multi-factor authentication for email, accounting, banking, the CRM, the shared drive and the website’s admin login, starting with whatever holds sensitive client or financial data.
2. Week two: updates. Set automatic updates on every laptop, phone and browser. Check which software and operating systems the vendor no longer supports and plan to replace them. Remove browser extensions and programs nobody uses.
3. Week three: admin rights and macros. Take admin rights off everyday staff accounts. Whoever needs admin access gets a separate admin login, used only for that work and never for email or browsing. Turn off Office macros for anyone who does not need them, and block macros in files from the internet.
4. Week four: backups. Confirm what is backed up: files, email, accounting data, application settings and the website. Make sure staff accounts cannot delete the backups. Then restore one real folder or file to prove it works, and write down how long it took.

Application control and the remaining browser and Office hardening settings usually need someone who manages your devices centrally. Put them on the list for your IT provider rather than leaving them out.

A worked example: if a restore test shows that getting the shared drive back would take two days, ask what two days without client files would cost in missed work and wages. That figure is your own measure of how much better backups are worth.

Questions to ask your IT provider

If someone else looks after your computers, these questions cover the Essential Eight in one meeting:

• Which maturity level are we at for each of the eight strategies, and what would it take to reach Level One across all of them?
• How quickly are critical updates applied to our online services, and who checks?
• Which accounts have admin rights, and do those people have separate admin logins?
• Is application control running on our workstations?
• Could a staff account, or an attacker using one, delete our backups? When did we last test a restore?

ASD’s FAQ says it does not publish a list of approved products for the Essential Eight. Organisations choose products against their own requirements, so be wary of anyone who says a single product makes you compliant.

Where your website fits

Your website counts as an online service. ASD’s FAQ lists web hosting services and social media accounts as examples of online services holding less sensitive data, and the patching, multi-factor authentication and backup requirements apply to online services. That means the website’s software and plugins need prompt updates, its admin logins need a second factor, and its backups need to sit where a stolen login cannot delete them.

Our small business website security checklist covers the website side step by step, and our guide to website backups explains what a backup you can restore looks like. If email is your weak point, DMARC, SPF and DKIM stop others sending mail in your name.

CentriWeb’s managed hosting looks after the websites we build, so the site is one less item on your own list. For questions about the Essential Eight itself, ASD takes calls on 1300 CYBER1 (1300 292 371), and more guides for running an office are under systems.