The Australian Signals Directorate’s Essential Eight is the most widely referenced cybersecurity framework for Australian businesses — but despite its prominence, many organisations don’t fully understand what it covers, why it matters, or how to implement it. This guide explains the Essential Eight in plain language and outlines what compliance looks like for a typical small or medium business.
What Is the Essential Eight?
The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate. Originally developed for government agencies, the framework has become the de facto cybersecurity baseline for Australian businesses of all sizes. The eight strategies are designed to be implemented together — each one addresses different attack vectors and they’re most effective as a combined set rather than individual controls.
The Eight Strategies
- Application control — preventing unapproved programs from executing on your systems. Rather than trying to block all malware (a losing battle), application control only allows known good software to run.
- Patch applications — keeping internet-facing applications (browsers, email clients, office software, PDF readers) patched within 48 hours of a critical update being released.
- Configure Microsoft Office macro settings — most ransomware and malware is delivered via malicious macros embedded in Office documents. Restricting macro execution to signed, trusted macros blocks a huge proportion of attacks.
- User application hardening — configuring applications to reduce their attack surface: disabling Flash, Java browser plugins, and other legacy technologies that are no longer needed but still exploitable.
- Restrict administrative privileges — staff should only have administrative rights when they genuinely need them. Most users can operate perfectly well without local admin, and restricting these rights dramatically limits the damage a successful attack can cause.
- Patch operating systems — similar to patching applications, but focused on the underlying operating system. Critical OS patches should be applied within 48 hours for internet-facing systems.
- Multi-factor authentication (MFA) — requiring a second form of verification (typically a phone app or hardware token) to log in to systems, particularly for remote access and privileged accounts.
- Regular backups — maintaining regular, tested backups that are stored separately from the main environment so they can’t be encrypted by ransomware.
Maturity Levels
The ACSC defines three maturity levels for Essential Eight implementation. Maturity Level 1 provides protection against opportunistic attacks — the most common type targeting SMBs. Maturity Level 2 provides protection against more targeted attacks. Maturity Level 3 provides protection against sophisticated, persistent threat actors.
For most small and medium businesses, achieving Maturity Level 1 across all eight strategies is the appropriate starting target. It addresses the overwhelming majority of threats you’ll actually face, without requiring the significant investment needed for higher maturity levels.
How Kinsoft Can Help
Implementing the Essential Eight isn’t technically difficult, but it does require systematic effort and knowledge of the specific tools and configurations involved. Kinsoft conducts Essential Eight gap assessments for Sydney businesses — reviewing your current environment against each control and providing a prioritised remediation roadmap. Our managed IT support clients benefit from ongoing Essential Eight maintenance as part of their plan.
Ready to understand your Essential Eight posture? Contact Kinsoft for a free cybersecurity consultation.