Essential Eight explained in one line: it is a short list of eight security steps from the Australian Signals Directorate (ASD) that makes it much harder for attackers to break into a business. Using it takes no security training. What helps is knowing what the eight are and which questions to ask the person who looks after your IT.
The Essential Eight sits inside a longer ASD document called the Strategies to Mitigate Cyber Security Incidents. ASD picked the eight most effective strategies from that list. It tells organisations to use them as a baseline. The agency is clear that no set of steps can stop every attack. The aim is to raise the cost and effort for the attacker.
The eight steps in plain words
Here is each one, with what it means for a small firm.
- Patch applications. Install updates for programs such as browsers, PDF readers and office software, so known holes are closed.
- Patch operating systems. The same idea for Windows, macOS and the system on your servers and network gear.
- Multi-factor authentication. A password plus a second proof, such as a code from an app, before anyone can log in.
- Restrict administrative privileges. Only a few people get admin rights, and those people do not use them for email or browsing.
- Application control. Only approved programs are allowed to run on a computer.
- Restrict Microsoft Office macros. Macros are small scripts in Office files. Attackers hide malware in them, so they are turned off for people who do not need them.
- User application hardening. Risky features in browsers and other software, such as Java content and ads from the web, are switched off.
- Regular backups. Copies of data are made often, kept safe, and tested to confirm they can be restored.
What the maturity levels mean
ASD also publishes the Essential Eight Maturity Model. It first appeared in June 2017 and was last updated in November 2023. The model sets out four levels, from Maturity Level Zero to Maturity Level Three. Level Zero means there are weaknesses an attacker can use. Levels One to Three match attackers of rising skill.
Level One is aimed at attackers who use common tools and look for any victim. Think of someone who uses a public exploit on software that was never updated, or who logs in with stolen or guessed passwords. Level Two targets attackers who put in more time and are better at getting around controls. Level Three covers attackers who adapt and rely less on public tools.
ASD advises organisations to pick a target level that suits their environment. It also says to bring all eight steps up to the same level before moving higher. For most small firms, Level One across all eight is a sensible first target to discuss. Your provider can tell you where you stand today.
One more point matters when you buy IT services. The model says there is no requirement to have your Essential Eight work certified by an outside party. Some government, regulator or contract rules may still ask for an independent assessment.
What Level One asks for, in practice
The model lists exact tests for each level. A few examples at Level One give a feel for how concrete they are.
- Patching: fixes for online services are applied within 48 hours when a vulnerability is rated critical or a working exploit exists, and within two weeks otherwise.
- Multi-factor authentication: used for staff logging in to online services that hold sensitive business data, including third-party services.
- Macros: disabled for users with no business need, and blocked in files that come from the internet.
- Backups: data, applications and settings are backed up, kept safely, and restored in tests. Ordinary user accounts cannot change or delete the backups.
These are plain, checkable statements. That is the useful part. You can ask a provider whether each one is true for your business and get a yes, a no or a date.
Why small business should care
Size does not protect you. ASD's Australian Cyber Security Centre reports that in the 2022-23 financial year the average cost of cybercrime for a small business rose to $46,000. For a medium business it rose to $97,000. A figure like that can hurt a small firm badly.
The Centre also publishes a Small Business Cyber Security Guide and a checklist. For a starting point it recommends three simple actions: turn on multi-factor authentication, update your software and back up your information. Those three line up closely with steps in the Essential Eight. It also suggests that you speak to an IT professional or a trusted adviser if you have questions.
Questions to ask your IT provider first
You do not have to ask about all eight in one meeting. Start with three that give the most for the least effort, then add the rest over time.
- Is multi-factor authentication on for email, banking and cloud tools, and for every staff member?
- How fast do you apply updates, and who checks that they actually installed?
- When did you last restore a file from backup as a test, and can a staff account delete the backups?
Then ask who has admin rights, whether Office macros are turned off, and which programs are allowed to run. Ask the provider to put the answers in writing, with a date. Ask which maturity level they would call your business today. If they cannot answer, that tells you something too.
A good provider will welcome these questions and answer them in plain words. A vague answer is a reason to ask again.
The limits of the list
ASD says the Essential Eight is a minimum set of preventative steps. It will not stop every threat. It was built to protect internet-connected office networks, so other setups may need other measures. Businesses with higher risks should look at the wider Strategies to Mitigate Cyber Security Incidents and the Information Security Manual.
Also remember that a tidy report shows what was set up, not that staff follow it every day. Training and good habits still count.