At a Glance: Cybersecurity for Australian Small Business
| Core framework | The Essential Eight, developed by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC) |
| First published | 2017, as part of the ASD’s Strategies to Mitigate Cyber Security Incidents |
| Who it’s for | Organisations of every size, though it was originally built with government agencies in mind |
| Legally required? | Mandatory for Commonwealth government entities; not legally required for most private businesses, but increasingly expected by insurers and larger clients |
| Related reading | See our guide on why dedicated servers matter for your organisation |
Why This Matters for a Small Business, Not Just Government
Many small businesses assume cybersecurity frameworks are built for banks, hospitals and federal agencies – not a ten-person accounting firm or a family-run online store. In practice, smaller businesses are attractive targets precisely because they tend to have weaker defences and less capacity to recover from an incident. A single ransomware attack or compromised email account can shut down operations for days, and recovery costs (IT remediation, lost revenue, customer notification, reputational damage) regularly outweigh what proper prevention would have cost.
Company directors also carry a general duty under the Corporations Act 2001 to govern risk within the business, and cyber risk increasingly falls under that umbrella. You don’t need a dedicated security team to take meaningful action — you need to know which controls matter most and tackle them in order.
The Essential Eight, Explained Simply
The Essential Eight groups eight controls into three broad goals: stopping attacks from succeeding, limiting how far an attack can spread if it does succeed, and making sure you can recover data if something goes wrong.
| Strategy | What it means in practice | Goal |
|---|---|---|
| Application control | Only approved software can run on business devices | Prevent |
| Patch applications | Update software (browsers, PDF readers, etc.) promptly when fixes are released | Prevent |
| Configure Microsoft Office macro settings | Block macros from the internet by default, since they’re a common malware delivery method | Prevent |
| User application hardening | Disable risky features like Flash, ads and Java in browsers | Prevent |
| Restrict administrative privileges | Only give admin-level access to people who genuinely need it, and review regularly | Limit spread |
| Patch operating systems | Keep Windows, macOS and server operating systems updated | Prevent |
| Multi-factor authentication (MFA) | Require a second verification step for logins, especially email and remote access | Prevent |
| Regular backups | Keep backups that are tested, stored separately from your main systems, and quick to restore | Recover |
If you can only act on one control this month, make it multi-factor authentication. Investigations into real-world incidents consistently find that MFA alone would have stopped a large share of successful attacks.
Understanding Maturity Levels
The ACSC doesn’t expect every business to implement every control perfectly overnight. Instead, the Essential Eight uses a four-level maturity model to show how thoroughly an organisation has implemented each control.
| Level | What it looks like |
|---|---|
| Level 0 | No meaningful controls in place; weaknesses have not been addressed |
| Level 1 | Basic controls exist but may be inconsistent or undocumented |
| Level 2 | Controls are systematically implemented and monitored across the business |
| Level 3 | Controls are mature, actively tuned against current threats, and reviewed regularly |
For most small and medium Australian businesses, Level 1 is a realistic starting point, with Level 2 a sensible target within six to twelve months — particularly if you deal with government contracts, financial services, or clients who ask about your security posture during procurement.
A Practical, Budget-Friendly Starting Point
- Turn on MFA everywhere you can — email first, then any remote access tools, cloud storage and financial software. Most platforms include this at no extra cost.
- Set software and operating systems to auto-update where possible, and check monthly for anything that’s fallen behind.
- Review who has admin access to your systems and remove it from anyone who doesn’t strictly need it.
- Set up automated, tested backups stored somewhere separate from your main network, so a ransomware attack can’t encrypt your backups too.
- Run a short staff briefing on recognising phishing emails — still the most common way attackers get in.
What This Costs vs. What an Incident Costs
Reports on Australian cybercrime consistently show a similar pattern: the direct cost of an incident (recovery, downtime, notification, and reputational impact) tends to run well into the tens of thousands of dollars even for a small business, and considerably more for larger ones. By comparison, businesses can implement much of the Essential Eight core – MFA, patching, backups and access reviews – using tools they already pay for. The main investment is often staff time rather than additional software.
Cyber Insurance and the Essential Eight
Cyber insurance has become far more common among Australian small businesses over the past few years, largely because the cost of a serious incident can be existential for a smaller operation. Recently, insurers have changed how they assess risk before offering a policy. Rather than a simple questionnaire, many insurers now ask specifically about multi-factor authentication, backup practices and patching cadence — in other words, several of the Essential Eight controls — before quoting a premium or paying out a claim.
This creates a practical incentive that goes beyond avoiding an attack: businesses that can demonstrate basic Essential Eight controls are often able to access better premiums, and are far less likely to have a claim disputed on the grounds that reasonable precautions weren’t in place. If you’re renewing or taking out a policy, it’s worth asking your broker directly which of the Essential Eight controls your insurer expects to see evidence of.
Common Myths That Hold Businesses Back
| Myth | More accurate view |
|---|---|
| “We’re too small to be a target” | Automated attacks don’t discriminate by business size; smaller businesses are often targeted precisely because defences tend to be weaker |
| “Antivirus software is enough” | Antivirus is one layer among several; MFA, patching and backups address different attack methods entirely |
| “This requires a full-time security hire” | The baseline controls can usually be implemented with existing tools and an afternoon of focused work per control |
| “We’ll deal with it after the next busy period” | Most incidents happen without warning; the controls only help if they’re in place beforehand |
Frequently Asked Questions
Does my business have to comply with the Essential Eight?
Not directly, unless you’re a Commonwealth government entity. However, cyber insurers, government procurement processes, and larger clients increasingly use it as an informal benchmark. As a result, many businesses now treat it as a practical necessity even when the law does not require it.
Do I need to hire a security specialist to get started?
Not for the basics. Your existing IT provider or a staff member who is reasonably comfortable with technology can usually set up multi-factor authentication, manage patching, and review backups. More advanced maturity levels typically do benefit from specialist input.
Which control should a small business prioritise first?
Multi-factor authentication and regular, tested backups tend to offer the best protection for the least effort, which is why most practical guides recommend starting there.
How often should you review the Essential Eight?
Review your systems at least once a year, and assess access permissions and test backups every quarter. Because staff and systems change quickly, regular reviews help you identify risks and address gaps before they become problems.
Final Thoughts
The Essential Eight isn’t a compliance checkbox exercise. It’s a prioritised, practical response to how most cyber incidents actually happen in Australia. Starting with multi-factor authentication, patching and backups covers a large share of real-world risk, and each of those steps is achievable without a dedicated security budget.
