Most Australian small businesses are further behind on the Essential Eight than they think — and they usually find out at the worst possible moment: during an incident, or at cyber-insurance renewal. The good news is that the Essential Eight was never meant to require a dedicated security team. It is a structured, achievable baseline, and a small business running Microsoft 365 can reach a defensible level of maturity with methodical work rather than specialist expertise.
This playbook explains what the Essential Eight actually is, why Maturity Level 2 is the right target for an SMB, and gives you one concrete first action for each of the eight controls.
1. What the Essential Eight actually is
The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre. According to the ACSC, the strategies are designed to make it "much harder for adversaries to compromise systems" (cyber.gov.au — Essential Eight, accessed 30 June 2026). It has become the de facto cyber baseline for Australian organisations, referenced by government, insurers, and auditors alike.
The eight controls are: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. The ACSC groups them under three objectives — preventing attacks, limiting the extent of attacks, and recovering data and system availability (cyber.gov.au — Essential Eight Maturity Model, accessed 30 June 2026).
2. Why Maturity Level 2 is the realistic SMB target
The Essential Eight is measured on a maturity scale from Level 0 to Level 3. The ACSC describes each level as being aligned to the tradecraft and targeting of increasingly capable adversaries: Level 1 mitigates opportunistic attackers using widely available tools, Level 2 addresses attackers willing to invest more time and effort, and Level 3 targets highly capable, well-resourced adversaries (cyber.gov.au — Essential Eight Maturity Model, accessed 30 June 2026).
For an Australian SMB without a dedicated security team, Maturity Level 2 is the realistic and defensible target. Level 3 generally requires specialist tooling, continuous monitoring, and staff that small businesses do not have. The ACSC itself recommends that organisations reach a consistent maturity level across all eight strategies before progressing to the next, rather than reaching Level 3 on one control while sitting at Level 0 on another. The practical SMB goal, then, is an even Level 1 first, then an even Level 2.
3. The eight controls in plain English
Each control below comes with one concrete first action. None of them require a security team, and most are configurable inside Microsoft 365 Business Premium.
Application control
Application control limits which programs are allowed to run, so unapproved or malicious software simply cannot execute. The ACSC describes it as one of the most effective mitigation strategies (cyber.gov.au — Essential Eight, accessed 30 June 2026). First action: turn on Microsoft Defender Application Control or Windows Smart App Control on your managed devices in audit mode, so you can see what would be blocked before you enforce it.
Patch applications
Unpatched applications — especially browsers, PDF readers, and Office — are among the most common entry points. The ACSC sets timeframes for patching based on the severity of the vulnerability. First action: enable automatic updates for browsers and Microsoft 365 Apps, and set a recurring monthly check for everything else. Aim to patch internet-facing applications within two weeks, and faster when a vulnerability is being actively exploited.
Configure Microsoft Office macro settings
Malicious macros remain a persistent infection vector for Australian businesses. First action: in the Microsoft 365 admin centre, block macros from the internet for all users and only allow macros where there is a demonstrated business need, with those exceptions documented. Microsoft blocks internet-sourced macros by default in current Office builds, but you should confirm the policy rather than assume it (learn.microsoft.com — macro security, accessed 30 June 2026).
User application hardening
Hardening reduces the attack surface by disabling risky features such as legacy browser plug-ins and unnecessary scripting. First action: disable or uninstall Internet Explorer mode where it is not required, and remove browser extensions that are not approved. Standardise on a single, supported browser configuration across the business.
Restrict administrative privileges
Administrator accounts are the keys to the kingdom, and standing privilege is what attackers exploit after the first compromise. The ACSC requires that privileged access be validated, limited, and logged (cyber.gov.au — Essential Eight Maturity Model, accessed 30 June 2026). First action: review who holds Global Administrator in Microsoft 365 — most small businesses have far more than they need. Reduce it to the minimum, and give administrators a separate account for admin tasks rather than using their everyday login.
Patch operating systems
Operating system vulnerabilities are exploited just as readily as application ones, and the ACSC applies similar patching timeframes. First action: enable Windows Update for Business or your device-management equivalent so operating system updates are applied automatically, and retire any device running an operating system that is no longer supported with security updates.
Multi-factor authentication
MFA is the single highest-value control for most SMBs, because it defeats the credential-theft attacks that drive the majority of business email compromise. Microsoft states that MFA can block the overwhelming majority of automated identity attacks (learn.microsoft.com — how MFA works, accessed 30 June 2026). First action: enforce MFA for every user on every cloud application using a Conditional Access policy, with no blanket exclusions, and require phishing-resistant methods for administrators. (For the insurance evidence angle, see our guide on MFA attestation for Australian SMBs.)
Regular backups
Backups are what turn a ransomware catastrophe into an inconvenience. The Essential Eight requires that backups are performed, retained, and — critically — tested for restoration. First action: confirm you have backups of business-critical data that are kept separate from your production environment, and actually perform a test restore this quarter. A backup you have never restored is a hope, not a control.
4. How cyber insurers now grade your Essential Eight
Cyber insurance has changed. Renewal questionnaires that once asked a simple yes or no now ask for documented evidence, and the controls underwriters scrutinise most are drawn straight from the Essential Eight: multi-factor authentication, patching cadence, and restricted administrative privileges. An organisation that cannot demonstrate these controls pays more, or struggles to get cover at all.
This is why a documented Essential Eight baseline is now a commercial asset, not just a security one. It makes renewal faster, supports a better premium, and gives you defensible evidence if you ever need to make a claim. We cover the evidence side in detail in our companion guide on MFA attestation for Australian SMBs.
5. You can baseline this yourself
There is a well-regarded three-day Essential Eight assessment course offered through the Australian TAFE network at around 2,100 dollars per seat — genuinely valuable if you already know what you are assessing. But most small businesses do not need to send a staff member on a course to take the first step. The Essential Eight is a baseline you can begin measuring yourself, and the most useful starting point is simply knowing where you stand.
A structured baseline assessment maps your current controls against the Essential Eight Maturity Model and tells you two things that matter: your current maturity level, and the two controls to prioritise first. That is the difference between guessing and acting.
6. Compliance with Australian regulations
The Essential Eight does not exist in isolation. Under the Privacy Act 1988, organisations covered by the Act must take "reasonable steps" to protect the personal information they hold, and a breach of personal information can trigger obligations under the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner (oaic.gov.au — Notifiable Data Breaches, accessed 30 June 2026). Implementing the Essential Eight is one of the clearest ways an Australian business can demonstrate that it has taken reasonable technical steps.
Key alignment for SMBs:
- Privacy Act "reasonable steps": the Essential Eight controls are concrete, documented evidence of reasonable technical measures.
- Notifiable Data Breaches scheme: strong MFA, patching, and backups materially reduce the likelihood and impact of a notifiable breach.
- ACSC guidance: the Maturity Model gives you a recognised yardstick that insurers and auditors already understand.
Call to action
The Essential Eight is achievable for an Australian small business without a security team. The work is methodical: reach an even Maturity Level 1 across all eight controls, then progress evenly toward Level 2, prioritising MFA, patching, and restricted administrative privileges along the way.
Next steps: before you change a single setting, find out where you actually stand. A documented baseline takes ten minutes, tells you your maturity level, and shows you the two controls to fix first — evidence you can act on and share with your insurer.
Sources referenced in this article: Australian Cyber Security Centre (cyber.gov.au), Microsoft Learn, Office of the Australian Information Commissioner.
