The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) to make organisations harder to compromise. It can feel like it was written for big enterprises with security teams — but every one of the eight maps to something a small business can actually do. This guide translates them into plain English.
The eight controls
- Application control — only approved programs are allowed to run.
- Patch applications — keep browsers, PDF readers, and other apps up to date.
- Configure Microsoft Office macro settings — block macros from the internet.
- User application hardening — disable risky features like Flash and unneeded browser add-ons.
- Restrict administrative privileges — most people should not be local admins.
- Patch operating systems — keep Windows and servers current.
- Multi-factor authentication (MFA) — a second factor on logins.
- Regular backups — and, critically, tested restores.
Maturity levels, briefly
The Essential Eight is measured in maturity levels:
- Level Zero — the control is largely absent.
- Level One — protects against widespread, opportunistic attacks (the level most small businesses should target first).
- Level Two and Three — for organisations facing more capable, targeted adversaries.
You do not need to be at Level Three to be meaningfully safer. Getting from Zero to One stops the vast majority of common attacks.
What "Level One" looks like in practice
For a typical small business running Microsoft 365, a realistic first pass looks like this:
| Control | A practical Level One step |
|---|---|
| MFA | Enforce MFA on every account via Entra ID Conditional Access |
| Restrict admin | Remove standing local-admin rights; use a separate admin account |
| Patch apps & OS | Turn on automatic updates and Intune update policies |
| Office macros | Block macros from the internet by policy |
| Backups | Back up Microsoft 365 and devices, and test a restore |
| App control | Start with an allow-list on your most sensitive machines |
Most of this is achievable with the Microsoft 365 Business Premium licensing many small businesses already pay for — it is largely a matter of turning the right things on and configuring them correctly.
Why it is worth doing now
Two forces are making the Essential Eight a business issue, not just an IT one:
- Cyber insurance. Insurers increasingly ask whether you have MFA, tested backups, and endpoint protection — and decline claims when the answer turns out to be no.
- Supply chains. Larger clients and government buyers are starting to require evidence of baseline security before they will work with you.
Where to start
You cannot improve what you have not measured. An Essential Eight gap assessment tells you your current maturity against each control and gives you a prioritised, costed roadmap to Level One — plus the evidence pack auditors and insurers ask for.
Talk to Umbrella Technology for a no-obligation conversation about where your business stands today.