The Australian Cyber Security Centre's Essential Eight is Australia's most widely referenced cybersecurity framework for mitigating common attack methods. It was designed to be practical rather than theoretical, with controls assessed as having the highest impact against the most common cyberattack types. While mandatory for Commonwealth government agencies, it serves as an excellent baseline for any Australian business.
The Eight Controls, Explained in Plain English
1. Application Control
Only allow approved applications to run on systems to prevent malware execution. Implemented using tools like ThreatLocker, AppLocker, or Windows Defender Application Control (WDAC). This control is challenging to implement but highly effective.
2. Patch Applications
Keep all applications current. The ACSC targets are: critical patches within 48 hours for internet-facing applications, two weeks for standard applications. An RMM tool can automate this across your fleet.
3. Configure Microsoft Office Macro Settings
Macros in Office documents have served as significant malware vectors. The control requires disabling macros from the internet entirely, and only allowing digitally signed macros from trusted publishers where macros are genuinely needed. Recent Microsoft Office versions now block macros from internet sources by default.
4. User Application Hardening
Configure web browsers and applications to reduce attack surface. This includes blocking Flash, disabling JavaScript on untrusted sites, blocking web advertisements, and ensuring PDF readers don't execute untrusted content. Browser-based controls like Edge's Enhanced Security Mode help here.
5. Restrict Administrative Privileges
Limit administrator rights and prevent admin accounts from everyday tasks like email and web browsing. The principle of least privilege — give users exactly the access they need and nothing more — is fundamental here. Admin privileges should be documented, reviewed regularly, and removed when unnecessary.
6. Patch Operating Systems
Apply OS patches within 48 hours for critical systems and two weeks for standard systems. Remove unsupported operating systems. Windows 10 reached end of life in October 2025 — if you are still running it, this is urgent.
7. Multi-Factor Authentication
Enable MFA for all users on internet-facing systems and for privileged accounts on internal systems. At higher maturity levels, phishing-resistant MFA (FIDO2) is required for privileged access. This is the most immediately accessible control for most SMBs and delivers significant risk reduction quickly.
8. Regular Backups
Perform and test backups of important data, software, and configuration settings. Backups must be protected from modification and deletion (immutable), and restore processes must be tested regularly. At higher maturity levels, unprivileged accounts cannot access backup repositories.
The Maturity Model: Where Should You Aim?
Each control has three maturity levels (ML1–ML3). ML1 addresses common, opportunistic attacks; ML2 targets sophisticated attacks; ML3 addresses persistent adversaries.
For most Australian SMBs, achieving Maturity Level 2 across all eight controls is a realistic and meaningful target. ML2 means controls are consistently implemented, automated where possible, and exceptions are documented and managed. The recommended approach involves starting with a gap analysis to assess current standing, then building a prioritised remediation roadmap.
Key Takeaways
- The Essential Eight focuses on controls with the highest real-world impact — practical rather than theoretical.
- Maturity Level 2 is achievable for most SMBs without enterprise-level resources.
- Begin with a gap analysis to understand current standing before planning improvements.
- MFA and patch management offer the most accessible quick wins for initial implementation.
Ready to stop fighting your IT?
Book a free, no-obligation IT assessment. We'll identify your biggest vulnerabilities and opportunities, and give you a clear roadmap, whether you engage us or not.