The Essential Eight explained for Australian small businesses

Key takeaways

• The Essential Eight is free guidance from the Australian Government's cyber security agency.
• It targets the techniques behind most cyber security incidents: stolen passwords, unpatched software, malicious documents and ransomware.
• The Essential Eight maturity model has four maturity levels, from Zero to Three. Most small businesses should target Maturity Level One first.
• It's mandatory for non-corporate Commonwealth entities, and increasingly expected by insurers and clients.
• The controls carry across to ASD's new Essentials series.

What is the ACSC Essential Eight?

The Essential Eight is ASD's prioritised list of cyber security measures for protecting internet-connected IT systems, promoted by the Australian Cyber Security Centre (ACSC), part of ASD. It was first published in 2017, building on ASD's "Top Four" strategies from 2012, and sits alongside ASD's larger Information Security Manual and its broader list of Strategies to Mitigate Cyber Security Incidents. The framework aims to make it much harder for adversaries to compromise systems.

It's free, it's part of the Australian Government's efforts to lift cyber security across the economy, and it's the yardstick most Australian insurers, auditors and government buyers use when they ask how secure a business is.

Why the Essential Eight matters for small businesses

Most cyber threats facing small businesses aren't sophisticated. They are stolen passwords, unpatched software, a malicious attachment, or an email account taken over and used to redirect a payment. The Essential Eight strategies are designed around exactly those techniques.

The numbers are real. In ASD's Annual Cyber Threat Report 2024–25, the average self-reported cost of cybercrime for a small business was $56,600 per report, up 14% on the year before. Email compromise (19%) and business email compromise fraud (15%) were the two most common cybercrimes reported by Australian businesses. Several Essential Eight controls, especially multi-factor authentication and restricting admin privileges, target that directly and protect customer data and other important data.

The Essential Eight mitigation strategies explained

ASD's own descriptions of each strategy's intent are on cyber.gov.au. The table is a simplified summary, not a replacement for ASD's wording.

Essential Eight maturity levels

The Essential Eight maturity model describes each control at four maturity levels:

• Maturity Level Zero. Weaknesses that leave systems exposed.
• Maturity Level One. Protects against opportunistic attackers using widely available tools.
• Maturity Level Two. Protects against attackers willing to invest more time and effort, and to target a specific organisation.
• Maturity Level Three. Protects against skilled, adaptive attackers targeting a specific organisation.

The ACSC recommends reaching the same maturity level across all eight controls before moving to a higher target maturity level. A business at Level Two on MFA but Level Zero on backups is still exposed.

Which target maturity level does a small business need?

For most small businesses, Maturity Level One across all eight controls is the right first target, with Level Two on multi-factor authentication, admin privileges and regular backups where you hold sensitive customer data or handle payments. Businesses that supply government, handle health or financial records, or need it for cyber insurance may be asked for Level Two. Your desired maturity level depends on your threat environment: who might target you, and what a bad week would cost.

Is the Essential Eight mandatory?

For private businesses, no. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework. For everyone else, it becomes a requirement indirectly: through cyber insurance questionnaires, government and enterprise supply contracts, and professional bodies that point members to it.

Separately, most businesses with turnover above $3 million, and all health service providers, have obligations under the Privacy Act 1988, including the Notifiable Data Breaches scheme. The Essential Eight is one of the most practical ways to show you're taking reasonable steps to protect personal information.

Essential Eight implementation: where to start

1. Run a gap assessment. Assess each control against the maturity model to see where you are today.
2. Set a target maturity level for all eight controls, usually Level One.
3. Fix the quick wins first: MFA everywhere, Office macro settings, automatic patching.
4. Tackle the harder controls: admin privileges and application control.
5. Prove it: keep evidence such as MFA reports, patch reports and backup restore tests.

Essential Eight checklist

1. MFA is enforced for every staff account on email, Microsoft 365 and remote access.
2. Nobody uses an administrator account for day-to-day work.
3. Operating systems and applications update automatically, and someone checks the report.
4. No devices run unsupported software or operating systems.
5. Office macros from the internet are blocked.
6. Browsers and Office apps have a security baseline applied centrally.
7. Backups are protected from deletion with a normal login, and a restore has been tested in the last three months.
8. There's a plan for application control.

Continuous improvement and ongoing compliance

Essential Eight compliance isn't a one-off project. Systems change, new staff join, exceptions creep in, and a business that reached Maturity Level One last year can slip back without noticing. This is compliance drift. Reassess at least annually, review exceptions quarterly, and treat each assessment as part of continuous improvement.

Common gaps

Across small businesses generally, the gaps that come up most often are:

• MFA with exceptions: a shared mailbox, an old admin account or the owner's phone.
• Staff with local admin rights, often left over from one software install years ago.
• Backups that have never been restored.
• Unsupported devices still on the network.

How Static Computers assesses the Essential Eight

Static Computers' Essential Eight assessment checks each control against the current maturity model, shows where you sit, and gives you a prioritised plan to reach your target maturity level, starting with the fixes that remove the most risk for the least effort. It also flags which work maps across to ASD's new Essentials series.

Book a complimentary IT review to get a plain-English view of where your business stands.