Essential Eight for small business

What is the Essential Eight?

The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC). It's designed to make it much harder for attackers to get into your systems, and much easier to recover if they do.

• Application control: only approved software can run
• Patch applications: keep apps and browsers updated
• Configure Microsoft Office macro settings: block risky macros
• User application hardening: switch off features attackers abuse
• Restrict administrative privileges: admin rights only where needed
• Patch operating systems: keep Windows and macOS updated
• Multi-factor authentication: a password alone isn't enough
• Regular backups: backed up, kept safe and tested

Maturity levels, in plain English

Each strategy is measured at a maturity level from zero to three. Maturity Level One protects against common, opportunistic attacks and is a sensible goal for most small businesses. Level Two and Three are for organisations facing more targeted threats or with stricter obligations.

Do I have to comply?

For most private small businesses, the Essential Eight isn't a legal requirement. But clients, insurers, government contracts and larger partners increasingly ask about it, and it's the clearest checklist available for staying safe.

How we help

• A gap assessment of your Microsoft 365, devices and backups against each strategy
• A plain-English report showing where you are and what to fix first
• Uplift work to reach Maturity Level One, then Level Two where it makes sense
• Ongoing monitoring so you stay there

We're an independent IT provider, not a certification body. We help you put the controls in place and document them, so you can answer client and insurer questionnaires with confidence.

Questions