If you run a small business in Geelong, you've probably heard the term "Essential Eight" thrown around - maybe from your IT provider, your cyber insurer, or a client who asked about your security posture. But what actually is it, and should you care?
The short answer: yes, you should care. The Essential Eight is the most practical cyber security framework available for Australian businesses, and it can dramatically reduce your risk of a breach. Here's what you need to know.
What Is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies developed by the Australian Cyber Security Centre (ACSC), which is part of the Australian Signals Directorate. It was designed specifically for Australian organisations and focuses on the most effective ways to prevent cyber attacks.
The ACSC found that implementing these eight strategies can prevent the vast majority of cyber incidents - including ransomware, phishing, and business email compromise - which are the most common threats facing small businesses right now.
The Eight Strategies Explained
Let's break each one down in plain English.
1. Application Control
This means only allowing approved software to run on your computers. If an employee accidentally downloads malware, application control blocks it from executing. Think of it as a bouncer for your systems - if the software isn't on the guest list, it doesn't get in.
2. Patch Applications
Software vendors regularly release security updates (patches) to fix vulnerabilities. This strategy requires applying those patches within 48 hours for critical vulnerabilities. That includes your web browsers, Microsoft Office, PDF readers, and any other applications your team uses daily.
3. Configure Microsoft Office Macros
Macros are small programs that run inside Office documents. Attackers love them because they can embed malicious code in a Word or Excel file that runs automatically when someone opens it. This strategy involves blocking macros from untrusted sources and only allowing them where there's a genuine business need.
4. User Application Hardening
This is about disabling risky features in everyday applications. For example, blocking Flash, Java, and web advertisements in browsers, and disabling OLE (Object Linking and Embedding) in Office. These features are common attack vectors that most businesses don't actually need.
5. Restrict Administrative Privileges
Admin accounts have the keys to the kingdom. If an attacker compromises an admin account, they can install software, change settings, and access everything. This strategy means only giving admin access to people who genuinely need it, and using standard accounts for day-to-day work.
6. Patch Operating Systems
Similar to patching applications, but for your operating systems - Windows, macOS, and any servers you run. Critical patches should be applied within 48 hours. Unsupported operating systems (like Windows 10 after October 2025) should be replaced entirely.
7. Multi-Factor Authentication (MFA)
MFA requires a second form of verification when logging in - typically a code from your phone or an authenticator app. Even if an attacker steals your password, they can't get in without that second factor. This is one of the most effective single controls you can implement.
8. Regular Backups
Backups are your last line of defence. If everything else fails and ransomware encrypts your data, a good backup means you can recover without paying the ransom. Backups should be automated, tested regularly, and stored separately from your main systems so ransomware can't reach them.
The Maturity Levels
The Essential Eight uses a maturity model with four levels:
- Maturity Level Zero - significant weaknesses in your cyber security posture
- Maturity Level One - partly aligned. Focuses on preventing common, opportunistic attacks
- Maturity Level Two - mostly aligned. Protects against more targeted attacks
- Maturity Level Three - fully aligned. Resilient against sophisticated adversaries
For most small businesses, Maturity Level One is the right starting point. It addresses the most common threats without requiring enterprise-level complexity. You can work toward higher levels over time as your security posture matures.
Why It Matters for Geelong Small Businesses
You might think cyber attacks only happen to big companies, but the numbers tell a different story. The ACSC receives a cybercrime report roughly every six minutes, and small businesses are among the most frequently targeted. The average cost of a cyber incident for a small business in Australia is over $46,000 - and that doesn't include reputational damage or lost clients.
Cyber insurers are also paying attention. Many now require evidence of basic security controls before they'll issue a policy or pay a claim. The Essential Eight gives you a recognised framework to point to.
If you work with government agencies or larger organisations, you may find that Essential Eight compliance is becoming a requirement in contracts and procurement processes.
Where to Start
You don't have to tackle all eight strategies at once. Here's a practical order for most small businesses:
- Enable MFA everywhere - Start with Microsoft 365, banking, and any cloud services. This is the single biggest security improvement you can make.
- Set up automated backups- Make sure your data is backed up to a location that ransomware can't reach. Test your restores.
- Automate patching - Use tools to keep your operating systems and applications up to date automatically.
- Restrict admin access- Audit who has admin privileges and remove any that aren't necessary.
- Tackle the rest - Application control, macro settings, and application hardening are more technical but round out your protection.
How Better Networks Can Help
We help Geelong small businesses work toward Essential Eight compliance in a practical, affordable way. We start with a free security assessment to understand where you stand today, then build a prioritised plan to close the gaps.
For managed IT clients, Essential Eight controls are built into your service - patching, monitoring, MFA enforcement, and backup management are all handled as part of your monthly plan.