What is the Essential 8? A Practical Guide for Australian Businesses

The Essential 8 is the Australian Cyber Security Centre's (ACSC) baseline set of cybersecurity strategies. If you're an Australian business that has been asked about your security posture by an insurer, a client, or a board, the Essential 8 is almost certainly what they're referring to. This guide breaks down each control, explains the maturity levels, and covers where most businesses should start.

What is the Essential 8?

The Essential 8 is a set of eight mitigation strategies designed to protect Australian organisations from common cyber threats. It was developed by the ACSC and is published as part of the Australian Government Information Security Manual (ISM). The eight strategies are grouped into three themes: preventing attacks, limiting the impact of attacks, and recovering from attacks.

The Eight Controls Explained

1. Application Control

Only approved applications can run on your systems. This stops malware, unapproved tools, and unwanted software from executing. In practice, this means configuring Windows Defender Application Control or a similar solution to block unauthorised executables, scripts, and installers.

2. Patching Applications

Keep internet-facing applications patched within 48 hours of a security patch being released. This covers web browsers, office suites, PDF readers, and anything else that handles untrusted content. Unpatched applications are one of the most common entry points for attackers.

3. Configuring Microsoft Office Macro Settings

Block macros from the internet and only allow vetted macros from trusted locations. Macros remain a primary delivery mechanism for malware, and most businesses don't need them running from external sources.

4. User Application Hardening

Configure web browsers and office applications to block features that introduce risk. This includes disabling Flash, blocking untrusted web content, and hardening email clients against malicious attachments.

5. Restricting Administrative Privileges

Limit admin accounts to dedicated, separate accounts that are only used for administrative tasks. Admin accounts should not browse the web, read email, or access untrusted content. This limits the damage if a user's primary account is compromised.

6. Patching Operating Systems

Keep operating systems patched within 48 hours of a security patch. This applies to servers, workstations, and mobile devices. Missing OS patches are routinely exploited by ransomware and other malware.

7. Multi-Factor Authentication (MFA)

Require MFA for all remote access, privileged accounts, and important data repositories. MFA is the single most effective control for preventing account compromise. It blocks the vast majority of credential-based attacks, even when passwords are stolen.

8. Regular Backups

Maintain tested, offline, and immutable backups of important data. Backups should be checked regularly to confirm they can be restored. This is your last line of defence against ransomware and data loss — if everything else fails, backups are what keep the business running.

Maturity Levels Explained

The Essential 8 has three maturity levels:

• Maturity Level 1 — Focuses on basic controls that protect against opportunistic attacks. This is the starting point for most businesses.
• Maturity Level 2 — Adds more stringent configuration and monitoring. Suitable for organisations that handle sensitive data or face targeted attacks.
• Maturity Level 3 — Represents a high level of resilience against advanced, targeted attacks. Typically required by government agencies and defence contractors.

Most small to medium Australian businesses should target Maturity Level 1 as a baseline and work towards Level 2 as their security maturity grows.

Where to Start

If you're starting from scratch, don't try to implement all eight controls at once. Prioritise by risk reduction:

1. MFA first — It's the highest-impact, lowest-effort control. Enable it everywhere you can.
2. Backups second — Confirm your backups are working, tested, and stored offline.
3. Patching third — Get a patching process in place for both applications and operating systems.
4. Admin privileges fourth — Separate admin accounts and remove local admin rights from standard users.
5. Application control and hardening last — These are more complex and benefit from the earlier controls being in place.

Essential 8 and Cyber Insurance

Australian cyber insurers increasingly require evidence of Essential 8 controls before issuing or renewing policies. The controls they care about most are MFA, patching, backups, and administrative privilege management. If you can demonstrate these, you're in a much stronger position when applying for or claiming on cyber insurance.