Small business security
The Essential Eight in plain English, for small businesses
The Essential Eight is the Australian Signals Directorate’s list of eight mitigation strategies that stop most common cyber attacks. It’s often mentioned in tenders, insurance forms and client questionnaires, usually with no explanation. Here’s what each one means for a small team, and what the ASD’s new “Essentials” framework, launched in October 2026, changes.
The short version
Where most small businesses should start
- Turn on multi-factor authentication everywhere.
- Keep devices and software patched.
- Back up properly and test restoring.
- Remove admin rights from everyday accounts.
What the Essential Eight is (and isn’t)
It’s a prioritised set of controls, published by the ASD, that make it much harder for attackers to get in, spread and cause damage. Each strategy has maturity levels from one to three, describing how thoroughly it’s implemented. Level one is aimed at protecting against common, opportunistic attacks, and is a sensible goal for many small businesses.
It isn’t a certification you buy, and it isn’t only for large organisations. Many of the controls cost very little with tools you already have, such as Microsoft 365 Business Premium or Google Workspace.
October 2026: the Essential Eight is evolving into ASD Essentials
In October 2026 the ASD launched ASD Essentials, which it describes as an evolution of the Essential Eight. It’s organised into chapters for different environments: Essentials for enterprise IT (the direct successor to the Essential Eight), Essentials for operational technology, and Essentials for cloud, which is aimed at organisations that run entirely on software-as-a-service such as Microsoft 365, Google Workspace and cloud apps.
What this means for a small business right now:
- Nothing you’ve done is wasted. The ASD says Essential Eight work carries forward, and it will maintain both frameworks during a transition period.
- Keep meeting existing requirements. The ASD says organisations should keep meeting their current regulatory obligations until regulators announce changes. If a contract or insurer asks about the Essential Eight, that question still makes sense.
- Cloud-only businesses should look at Essentials for cloud. If you have no servers and run everything in the cloud, it may be a better fit than the Essential Eight’s device-focused controls.
- The basics are the same. Multi-factor authentication, patching, limited admin rights and backups remain at the core.
We’ll update this guide as the ASD and regulators publish more detail.
The eight strategies
| Strategy | In plain English | Small business example |
|---|---|---|
| Patch applications | Install updates for software like browsers, Office, PDF readers and accounting apps quickly. | Automatic updates on, and a monthly check that they’re actually installing. |
| Patch operating systems | Keep Windows, macOS, phones and servers updated, and replace unsupported ones. | No Windows 10 PCs without Extended Security Updates. |
| Multi-factor authentication | Require a second step when people sign in. | MFA on email, remote access, accounting and banking for every person. |
| Restrict administrative privileges | Only give admin rights to people who need them, and only use them when needed. | Staff use standard accounts. The IT admin uses a separate admin login. |
| Application control | Only allow approved software to run. | Block software installs by staff, and use device management to control what runs. |
| Restrict Microsoft Office macros | Block macros from the internet, which are a common way malware arrives. | Macros disabled for anyone who doesn’t need them, and blocked in files from email. |
| User application hardening | Turn off risky features in browsers and apps. | Block web ads and old browser features, and turn off unneeded plugins. |
| Regular backups | Back up important data, keep backups separate and test restoring. | Daily backup of files and email, with a copy attackers can’t delete. |
A realistic order for small teams
All eight work together, but if you’re starting from scratch, this order gives the most protection soonest.
Multi-factor authentication
Stolen passwords are behind a large share of incidents. Turn on MFA for email and every cloud service first. See our two-step verification guide.
Backups
If everything else fails, good backups are what let you recover. Make sure at least one copy can’t be changed or deleted from your normal accounts. See backups that actually work.
Patching
Turn on automatic updates and replace unsupported devices. See keeping devices updated.
Admin rights
Remove admin rights from everyday accounts. It’s free and dramatically limits what malware can do.
Macros and application hardening
Set these through Microsoft 365 or your device management tool. They’re mostly a one-off configuration.
Application control
The most technical of the eight. It’s worth doing with help from your IT provider once the basics are in place.
Be honest about where you are
If a client or insurer asks whether you meet the Essential Eight, describe what you’ve actually implemented and to which maturity level. Overstating it can cause real problems if there’s an incident, including with insurance claims.
How to check where you stand
- List your devices, accounts and key software. You can’t protect what you don’t know about.
- Go through the eight strategies and note, honestly, whether each is done, partly done or not started.
- Read the ASD’s maturity level one requirements for each one, which are specific and readable.
- Make a short plan with owners and dates, and review it every quarter.
Common questions
Is the Essential Eight compulsory for my business?
Not for most private businesses, but it’s mandatory for many government agencies, and some government contracts and clients expect it. It’s also a well-recognised baseline insurers and clients understand.
How much does it cost?
Much of maturity level one can be done with Microsoft 365 Business Premium or similar plans, plus time. Application control and testing usually need more expertise.
Do we need all eight before anything else?
No. Start with MFA, backups and patching, and work through the rest in order.
Sources
- Australian Signals Directorate: ASD Essentials, evolving our approach
- Australian Signals Directorate: Essentials for cloud
- Australian Signals Directorate: Essential Eight
- Australian Signals Directorate: Essential Eight maturity model
- Australian Signals Directorate: Small business cyber security handbook
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.