The Essential Eight: A plain-English guide for Australian small business owners
This article is general in nature and does not constitute personal or IT security advice. For cyber security implementation, consult a qualified IT security professional or refer to the ASD's guidance at cyber.gov.au.
What is the Essential Eight and why should a small business care?
The Essential Eight is a set of eight cybersecurity controls published by the Australian Signals Directorate (ASD). It's Australia's practical, evidence-based baseline for protecting internet-connected systems against the most common cyber threats.
For government entities, some of it is mandatory. For small businesses, it isn't, but it's still the most practical framework available, and implementing it does two things: it meaningfully reduces your cyber risk, and it can support your Cyber Insurance position, both premiums and eligibility.
Insurers are increasingly asking whether applicants have implemented key Essential Eight controls, particularly multi-factor authentication (MFA). If you haven't, you may find cover harder to place or certain claims affected.
TL;DR
The Essential Eight is eight controls developed by Australia's cyber security agency to protect against the most common attack types. For small businesses, you may not need to implement all eight perfectly, you need to understand which ones matter most for your situation and work toward them in order. Start with MFA, backups, and patching. The rest follows.
Key facts
- The ASD receives a cybercrime report every 6 minutes in Australia. That's over 84,700 in the year (Source: ASD Annual Cyber Threat Report 2024–25)
- The average self-reported cost of cybercrime for a small Australian business is $56,600, up 14% (Source: ASD Annual Cyber Threat Report 2024–25)
- Business Email Compromise (BEC) — a form of Social Engineering Fraud — sits behind roughly one in three cybercrime incidents affecting Australian businesses (Source: ASD Annual Cyber Threat Report 2024–25)
- The ASD describes the Essential Eight as the most effective of its mitigation strategies for protecting against common cyber threats (Source: ASD, cyber.gov.au)
- Implementing the Essential Eight, particularly MFA, is now a factor in Cyber Insurance underwriting for many insurers
Table of contents
- The eight controls — explained simply
- The maturity model: what level do you need?
- Which controls matter most for small businesses?
- Essential Eight and Cyber Insurance
- FAQs
1. The eight controls explained simply
The ASD groups the Essential Eight into three objectives: preventing attacks, limiting the impact of attacks, and recovering from attacks. Here's what each control actually means in practice.
Control 1: Application control
What it is: Only allowing approved software to run on your systems. Blocking anything not on an approved list.
What it prevents: Malware and ransomware that installs itself disguised as legitimate software.
For small business: Full application allowlisting can be complex to implement. A practical starting point is ensuring your IT provider manages what software is installed on business devices and prevents staff from installing unapproved applications.
Control 2: Patch applications
What it is: Keeping all your applications updated. These include web browsers, Microsoft Office, PDF readers, accounting software, plugins.
What it prevents: Attackers exploiting known vulnerabilities in outdated software. Publicly reported vulnerabilities continue to rise year on year, and attackers often move on them quickly.
For small business: Turn on automatic updates for all business applications. Don't defer or ignore update prompts. This is one of the simplest and highest-impact controls available.
Control 3: Configure Microsoft Office macros
What it is: Restricting when and how macros can run in Microsoft Office documents, particularly ones received from external sources.
What it prevents: Macros are a common method of delivering malware through email attachments. Attackers send documents with malicious macros embedded.
For small business: In Microsoft 365, you can set macros to be blocked by default except for trusted, digitally signed files. Your IT provider can configure this in minutes.
Control 4: User application hardening
What it is: Configuring browsers and applications to reduce their attack surface — disabling features that are rarely needed but frequently exploited.
What it prevents: Browser-based attacks, scripting exploits, and web-based malware.
For small business: At minimum: disable legacy plug-ins that are no longer supported, block ads from unknown sources via browser settings or an ad blocker, and ensure browsers are set to warn about suspicious sites.
Control 5: Restrict administrative privileges
What it is: Limiting who has admin-level access to your systems and ensuring those accounts are used only when genuinely needed.
What it prevents: If an attacker compromises a standard account, limited privileges mean they can't easily install software, change system settings, or spread through your network.
For small business: Staff should use standard accounts for daily work. Admin accounts should be separate, used only for IT tasks, and not used for email or browsing. This is one of the most important and most overlooked controls for SMEs.
Control 6: Patch operating systems
What it is: Keeping your operating systems updated — Windows, macOS, iOS, Android.
What it prevents: Attackers exploiting vulnerabilities in unpatched systems. This is separate from patching applications. Operating systems need updates too.
For small business: Enable automatic OS updates on all devices used for business. Devices running end-of-life operating systems (Windows 10 after its support end, for example) should be upgraded.
Control 7: Multi-factor authentication (MFA)
What it is: Requiring a second verification step — a code, an app notification, or a hardware key — in addition to a password.
What it prevents: Password theft and credential-based attacks. Even if a password is compromised, MFA prevents the attacker from logging in without the second factor.
For small business: This is the highest-impact control for most SMEs. Enable MFA on email, cloud accounting software, banking, file storage, and any business application that holds sensitive data. Most platforms support it natively and it costs nothing to enable.
Note on MFA: MFA is essential but not a complete solution on its own. A significant share of modern attacks now involve techniques such as session hijacking, which can bypass standard MFA by stealing the login session after authentication. That's why MFA works best alongside the other controls here, not as a single silver bullet. (More in our BEC guide.)
Control 8: Regular backups
What it is: Creating and maintaining regular copies of your data in a location that is separate from your primary systems and testing that those backups can actually be restored.
What it prevents: Ransomware. If your systems are encrypted and you have clean, recent, offsite backups, you can recover without paying a ransom.
For small business: Use a cloud backup service that runs automatically. Keep at least one copy that is not connected to your live systems (so ransomware can't reach it). Test your restore process at least annually — don't assume the backup works until you've confirmed it.
2. The maturity model: what level do you need?
The ASD's Essential Eight Maturity Model defines four levels of implementation:
| Maturity level | What it means | Typically aimed at |
|---|---|---|
| Level 0 | Minimal or no controls in place | Not a safe place to be |
| Level 1 | Partly aligned — basic controls against common, opportunistic attacks | The ASD's baseline for most small and medium businesses |
| Level 2 | Mostly aligned — consistent controls against more capable adversaries | Larger enterprises and higher-risk environments |
| Level 3 | Fully aligned — rigorous, with regular review | Critical infrastructure, regulated and high-threat environments |
For most small businesses, Maturity Level 1 is the realistic and recommended target. The ASD frames Level 1 as the baseline for smaller organisations, with Level 2 aimed at larger enterprises. You don't need enterprise-grade tooling to get real protection. Level 1 done consistently — having MFA on internet-facing accounts, patches applied promptly, admin privileges restricted, backups tested — puts you ahead of the majority of opportunistic attacks, which is where most small-business risk actually sits.
As your business grows, or if you handle particularly sensitive data or sit in a regulated industry, working toward Level 2 becomes worthwhile.
3. Which controls matter most for small businesses?
You don't need to implement all eight perfectly at once. If you're starting from zero, this is the order that delivers the most protection fastest:
| Priority | Control | Why first |
|---|---|---|
| 1 | Multi-factor authentication | Highest-impact, lowest cost. Stops the vast majority of credential-based attacks |
| 2 | Regular backups | Ransomware protection. Useless if not tested |
| 3 | Patch applications and OS | Most exploited vulnerabilities are in unpatched software |
| 4 | Restrict admin privileges | Limits blast radius if a standard account is compromised |
| 5 | Configure macros | Blocks a common malware delivery mechanism |
| 6 | Application control | More complex to implement. Consider with IT support |
| 7 | User application hardening | Browser and application configuration |
Patching applications and operating systems is treated as a single priority here, which is why the eight controls map to seven rows.
4. The Essential Eight and Cyber Insurance
The Essential Eight has a direct relationship with your Cyber Insurance:
At underwriting: Many insurers now ask whether applicants have MFA enabled on email, cloud systems, and remote access. If the answer is no, you may face higher premiums, coverage conditions, or in some cases difficulty placing cover.
At claim time: A claim can arise from an attack vector that a specific Essential Eight control would have addressed. If that control was absent, some insurers may respond differently to the claim depending on the policy terms. This is particularly relevant for Social Engineering Fraud/BEC and ransomware.
The practical implication: Implementing the Essential Eight (even just controls 1–4) strengthens your Cyber Insurance position, may support your premiums, and reduces the chance of a dispute over a claim that better controls could have prevented.
Want to know how your cyber risk profile affects your Cyber Insurance options? Book a call with the Pocket team →
Essential Eight self-assessment
Run through this checklist. Any unticked box is a gap worth addressing.
MFA
- MFA is enabled on all business email accounts
- MFA is enabled on cloud accounting software (Xero, MYOB, QuickBooks)
- MFA is enabled on any system with customer or financial data
- MFA is enabled on remote access tools (VPN, RDP)
Backups
- Backups run automatically at least daily
- At least one backup copy is offsite or in a separate cloud environment
- I've tested restoring from backup in the last 12 months
- Backups are not connected to live systems (ransomware can't reach them)
Patching
- Automatic updates are enabled for all business applications
- Automatic OS updates are enabled on all business devices
- No devices are running end-of-life software
Admin privileges
- Staff use standard accounts for daily work, not admin accounts
- Admin accounts are only used for IT tasks, not email or browsing
Macros
- Microsoft Office macros are restricted to trusted, signed documents only
If you have 5 or more unticked boxes, your cyber risk profile has meaningful gaps. Book a call with the Pocket team to discuss how this affects your Cyber Insurance options.
Related guides
- Get an instant cyber insurance quote
- Business Email Compromise: what it is and how to protect your business
- Cyber insurance for Australian small businesses: what it covers and what it costs
- OAIC privacy compliance sweep 2026: what businesses need to know
Cyber security and cyber insurance work together
Implementing the Essential Eight reduces your risk. Cyber Insurance protects you when risk becomes reality. Pocket can help with both — reviewing your cyber insurance options and connecting you with trusted IT security partners.
If you'd like advice — book a call with the Pocket team →
If you want to move quickly — get a cyber insurance quote online →
With Pocket is a business name of Insurance Services Holdings Pty Ltd (ABN 36 612 629 295, AFSL 491165), a member of NIBA and part of the Steadfast Group. This article contains general information only and does not take into account your objectives, financial situation or needs. It is not personal or IT security advice. For cyber security implementation, consult a qualified IT security professional or the ASD's guidance at cyber.gov.au. Before acting on any information here, consider whether it is appropriate for your circumstances. Sources: ASD Annual Cyber Threat Report 2024–25 and ASD guidance (cyber.gov.au).
Frequently asked questions
What is the Essential Eight in Australia?
The Essential Eight is a set of eight cybersecurity controls developed by the Australian Signals Directorate (ASD) to help organisations protect against common cyber threats. It is mandatory for non-corporate Commonwealth entities and strongly recommended for all Australian businesses. More information at cyber.gov.au.
Is the Essential Eight mandatory for small businesses?
Not by law for most private sector businesses. It is mandatory for certain government entities. However, it is strongly recommended by the ASD for all businesses and is increasingly referenced in Cyber Insurance underwriting and client contract requirements.
What is the most important Essential Eight control for small businesses?
Multi-factor authentication (MFA) delivers the highest impact for most SMEs because it prevents the majority of credential-based attacks, the most common initial access method. Backups are a close second because they're the primary defence against ransomware.
How much does implementing the Essential Eight cost?
For most small businesses, the core controls cost little to nothing in software, they involve enabling features that already exist in Microsoft 365, Google Workspace, and your operating system. The main investment is time and, for more complex controls, IT support. Most SMEs can implement controls 1–4 (MFA, backups, patching, macro restrictions) within a few days with basic IT assistance.
Does implementing the Essential Eight reduce my Cyber Insurance premium?
Potentially. Insurers are increasingly asking about Essential Eight controls, particularly MFA, as part of the underwriting process. Having MFA in place can support your eligibility and premiums. Ask your broker to confirm what your specific insurer requires.
What maturity level does a small business need?
The ASD frames Maturity Level 1 as the baseline for most small and medium businesses — consistent, basic implementation of all eight controls, which protects against the common, opportunistic attacks that account for most small-business risk. Level 2 is generally aimed at larger enterprises, and Level 3 at critical infrastructure and high-threat environments. Start at Level 1 done well, and work toward Level 2 as you grow or if you handle sensitive data.
Can MFA be bypassed?
Standard MFA methods (SMS codes, authenticator apps) can be bypassed by sophisticated attacks — particularly session hijacking, which steals your login session after you've authenticated. Phishing-resistant MFA (hardware keys or passkeys) is more secure but more complex to implement. For most SMEs, any MFA is significantly better than none — but it's not a complete solution on its own.
What is the difference between patching applications and patching the operating system?
Patching applications means updating software running on your device — browsers, Office, PDF readers, accounting tools. Patching the operating system means updating Windows, macOS, or iOS itself. Both are separate and both are necessary. The Essential Eight treats them as distinct controls.
What does "restrict administrative privileges" mean in practice?
It means staff use standard user accounts for their day-to-day work, not admin accounts. Admin accounts (which can install software, change system settings, and access all data) are reserved for specific IT tasks and not used for email or browsing. This limits the damage if a standard user account is compromised.
Where can I get help implementing the Essential Eight?
The ASD publishes implementation guidance at cyber.gov.au. For hands-on implementation support, contact a qualified IT security provider or managed service provider familiar with the framework. Pocket can refer you to trusted partners — get in touch.