The short answer

The Essential Eight is a set of cyber security mitigation strategies developed by the Australian Signals Directorate to make it harder for attackers to compromise an organisation.

A small business does not need to become a government cyber security department to benefit from it.

The Essential Eight provides a useful framework for deciding what security controls should be implemented first.

What are the Essential Eight controls?

The framework covers eight areas:

1. Application control
2. Patch applications
3. Configure Microsoft Office macro settings
4. User application hardening
5. Restrict administrative privileges
6. Patch operating systems
7. Multi-factor authentication
8. Regular backups

Together, these controls address many of the common ways attackers gain access, increase privileges or cause damage.

Does every small business have to comply?

Not every Australian small business is legally required to implement the Essential Eight.

Requirements depend on the organisation, customers, contracts, industry and regulatory obligations.

However, that does not mean the framework is irrelevant to smaller businesses.

It is a useful benchmark for improving security even where formal compliance is not required.

Why is it particularly relevant in Canberra?

Canberra has a high concentration of organisations working with:

• government
• defence
• professional services
• regulated industries
• sensitive information

A supplier may therefore encounter security requirements because of its customers even if the business itself is relatively small.

Security capability can increasingly become part of winning and retaining contracts.

What is a maturity level?

The Essential Eight uses maturity levels to describe progressively stronger implementations of the controls.

The idea is not simply to tick eight boxes.

A business should implement controls in a consistent way appropriate to its threat environment.

Where should a small business start?

Start with fundamentals.

Ask:

• Does every important account use MFA?
• Are operating systems patched?
• Are applications patched?
• Are users unnecessarily local administrators?
• Are backups reliable?
• Could those backups be recovered?
• Are risky applications and macros controlled?

The answers will quickly show where obvious gaps exist.

Is Microsoft 365 enough?

Microsoft 365 can provide many of the tools needed to improve security, depending on licensing and configuration.

But buying a licence does not implement the security controls automatically.

Policies still need to be configured, monitored and maintained.

Essential Eight versus general cyber security

The Essential Eight is an excellent baseline, but it is not the entire cyber security program.

Businesses should also consider:

• staff awareness
• incident response
• network security
• vendor risk
• data protection
• cyber insurance requirements
• business continuity

Don't chase a score for its own sake

The objective is not to achieve an impressive cyber security number.

The objective is to reduce the chance that an incident stops your organisation from operating.

For a small business, practical controls implemented properly are far more useful than a complex security strategy nobody maintains.

Need an Essential Eight starting point?

ITS Canberra can review your current environment against practical cyber security controls and prioritise the improvements that will reduce risk first.