What it actually is

The Essential Eight is guidance from the ACSC — part of the Australian Signals Directorate. It isn’t a product you buy; it’s eight practical mitigation strategies that work together to make your systems much harder to break into and much quicker to recover.

The eight controls

  • Application control — only approved software can run
  • Patch applications — keep browsers, Office and plugins current
  • Restrict Microsoft Office macros
  • User application hardening — disable risky browser features
  • Restrict administrative privileges
  • Patch operating systems
  • Multi-factor authentication (MFA)
  • Regular, tested backups

Maturity levels

Each control is measured against Maturity Levels 0 to 3. Most small businesses should aim for a solid Level 1 first — a consistent baseline — before reaching for higher levels that suit larger or higher-risk organisations.

Where to start

If you do only three things this quarter, do these:

  • Turn on MFA everywhere — especially email and remote access
  • Keep operating systems and applications patched automatically
  • Back up your data and actually test a restore

From there, tightening admin privileges and macro settings gives you the next big lift. We can assess where you sit today and map a realistic path — no scare tactics, just the steps that matter most for your business.