The Essential Eight cybersecurity guidance, developed by the Australian Signals Directorate, sets out eight baseline mitigation strategies covering application control, patching, macro settings, user application hardening, administrative privileges, operating system patching, multi-factor authentication and regular backups.
Table of Contents
Essential Eight Cybersecurity Australia: What It Means for SMEs in Practice
The Essential Eight cybersecurity sets out eight baseline controls, and for a smaller business the question is never whether they are sensible. It is which to do first with limited time and budget. The eight are not equally difficult, and they are not equally valuable at the point you begin. This guide sets out both in plain terms.
Key Takeaways
What the Essential Eight Cybersecurity Actually Is
The ASD publishes the Essential Eight as part of its Strategies to Mitigate Cyber Security Incidents. The eight strategies are: application control; patch applications; configure Microsoft Office macro settings; user application hardening; restrict administrative privileges; patch operating systems; multi-factor authentication; and regular backups.
Each strategy has three Maturity Levels (ML1, ML2, ML3) that describe progressively more sophisticated implementation. A large government agency might be expected to achieve ML3 across all eight strategies. An SME with limited IT resources is more likely to start with ML1 and progress to ML2 in the highest-risk areas.
average self-reported cost of cybercrime per report for Australian small business in FY2023-24, up 8% on the previous year — ASD Annual Cyber Threat Report 2023-24
The Eight Strategies in Plain Terms for SMEs
A family constitution (sometimes called a family charter or family governance charter) is a broader document that sets out the family’s shared values, vision for the business, principles for participation, and governance framework for managing the intersection between family life and business life. It is typically not legally binding in the same way as a shareholders agreement, it operates as a statement of intent and a framework for decision-making, rather than as a contract.
A family constitution typically addresses: the family’s shared values and vision for the business; the principles that govern how family members participate in the business (qualifications required to work in the business, remuneration principles, performance expectations); the governance structure (board composition, family council, and the relationship between them); how family disputes are to be managed; the criteria for business succession; and how the family will make decisions about major transactions such as sale or acquisition.
Because a family constitution is not typically legally binding, its effectiveness depends on the family’s commitment to the principles it establishes. It works best when it is developed collaboratively, reflects genuine consensus, and is regularly reviewed as the family’s circumstances evolve.
1. Application Control
Allow only approved software to run on your computers and servers. Any application not on the approved list is blocked. For an SME, this typically means configuring Windows to allow only software installed by an IT administrator, preventing staff from installing unapproved applications that may introduce malware.
2. Patch Applications
Keep all software up to date. Apply security patches within 48 hours of release for internet-facing services, and within two weeks for other software. Unpatched software is the most common entry point for cyber attackers.
3. Configure Microsoft Office Macro Settings
Microsoft Office macros are a common vector for malware. Configure Office to block macros from the internet and to only allow macros that have been approved and digitally signed. Most SMEs do not need to use macros at all.
4. User Application Hardening
Disable or configure web browsers and other software to block high-risk features such as web advertisements and Java. For most SMEs, this means configuring a secure browser policy and disabling Flash and Java.
5. Restrict Administrative Privileges
Do not give every staff member administrator rights on their computer. Administrative accounts should only be used for IT management tasks, not for everyday work activities such as email and web browsing. Separate ‘admin’ accounts from ‘user’ accounts.
6. Patch Operating Systems
Apply operating system security patches within two weeks of release for internet-facing servers and workstations, and within one month for other systems. Do not use operating systems that are no longer supported by the vendor. They will not receive security patches.
7. Multi-Factor Authentication
Require a second verification step, beyond just a password, for all access to critical systems, email, cloud services, and remote access. Multi-factor authentication (MFA) is one of the most effective single controls for preventing account compromise. It should be implemented for all internet-facing services and for all administrative access.
8. Regular Backups
Back up critical data and systems regularly. Store backups in a location that is not connected to your production network. An offline or offsite backup cannot be encrypted by ransomware. Test your backups regularly to confirm that data can actually be restored. For most SMEs, this means a daily backup to cloud storage plus a regular offline backup.
Starting With the Highest-Impact Controls
An SME that has not previously structured its cybersecurity approach should prioritise MFA, patching, and restricted administrative privileges first. These three controls address the majority of the attack vectors used in common cyber incidents affecting Australian SMEs. Application control and regular backups follow closely.
The Essential Eight is not a compliance program. It is a risk management framework. The goal is to make your organisation materially harder to attack, not to achieve a certification. Proportionate implementation, focused on the controls with the highest impact for your specific risk profile, is more valuable than paper compliance with all eight strategies at a low maturity level.
Essential Eight cybersecurity Australia: where a smaller business starts
DBA Advisory assesses where a business currently sits and sequences the work by impact rather than by the order the list happens to be printed in.
The eight are not a checklist to be completed in order, and treating them that way is why implementations stall. Multi-factor authentication and regular, tested backups deliver most of the protection for most smaller businesses, and both can be in place quickly. Application control, at the top of the list, is the hardest to implement and the easiest to abandon halfway.
The eight strategies cover application control, patching applications and operating systems, macro settings, user application hardening, restricting administrative privileges, multi-factor authentication and backups. Start with the highest-impact controls, get them working properly, and treat maturity as something you raise deliberately rather than all at once.
Frequently Asked Questions (FAQs)
The Essential Eight is a cybersecurity framework developed by the Australian Signals Directorate (ASD), the Australian government's national cyber security and foreign signals intelligence agency. It specifies eight baseline mitigation strategies designed to prevent the most common cyber attacks. It is the most widely referenced cybersecurity benchmark for both government and private sector organisations.
The Essential Eight is not mandatory for private sector businesses under Australian law. It is mandatory for Commonwealth government agencies. However, it is widely adopted as a best practice standard by private sector organisations and is increasingly referenced in cyber insurance requirements, supply chain security assessments, and due diligence processes. Businesses in sectors handling sensitive data (including health, financial services, and professional services) have strong practical reasons to implement the framework.
Maturity Level 1 represents the baseline implementation of each Essential Eight strategy, designed to address opportunistic attacks: the kind of automated, untargeted attacks that make up the majority of cyber incidents affecting Australian SMEs. For example, ML1 for multi-factor authentication requires MFA for remote access and for privileged accounts, but not necessarily for all users across all systems. ML2 and ML3 involve progressively more comprehensive and solid implementation.
Implementation timelines depend on the SME's existing IT environment and the maturity level being targeted. Implementing MFA, patching, and restricted admin privileges at ML1 can typically be done within 30 to 60 days with the assistance of a qualified IT service provider. Progressing to ML2 across all eight strategies in a complex environment may take six to twelve months. DBA Advisory's cyber governance services include an Essential Eight gap assessment and implementation roadmap.
How DBA Advisory Supports You
DBA Advisory offers fixed-fee Cyber governance advisory, Essential Eight gap assessment, and data protection compliance engagements with no hidden costs. Contact our team at dbaadvisory.com to discuss your requirements. General information only, not legal, tax, or compliance advice. Verify all obligations against current AUSTRAC, ATO, and legislative guidance.
DBA Advisory helps Australian businesses and professional services firms turn compliance obligations into systems that run reliably, with senior review at every step and fixed-fee certainty.
The Operational Resilience Framework covers the seven back-office systems every growing business needs (finance, compliance, workforce, IT, process, governance and visibility) with a scored fifteen-minute self-assessment. Download it free or book a meeting today!
Disclaimer
© DBA Advisory 2026. This article is intended as general information only and does not constitute legal or compliance advice. Businesses should seek qualified advice specific to their circumstances and confirm all regulatory references against current guidance before acting on any information contained in this article.
Related Insights
We build the resilient foundations
empowering you
to scale your business
Get in touch
Alquin Dagamina
Business Transformation and Technology Services, Manager
- Alquin.Dagamina@dbaadvisory.com
- 09158918379
