Essential Eight Compliance: A Guide for Australian SMEs
If you’re doing business with Australian government agencies, applying for government contracts, or simply wanting to meet modern cybersecurity standards, you’ll encounter “Essential Eight” compliance requirements. But what actually is Essential Eight, and what does compliance mean for your small business?
The Essential Eight is a set of eight cybersecurity strategies published by the Australian Signals Directorate (ASD). Originally developed to help Australian government agencies protect themselves against cyber attacks, it’s now become the de facto standard for security across Australian business. Insurance companies reference it, government contracts require it, and any business serious about cybersecurity should be working toward it.
What Is the Australian Signals Directorate?
The ASD (part of the Department of Defence) is Australia’s signals intelligence and cybersecurity agency. They publish security guidance based on real-world threat intelligence—they know what attacks are happening against Australian government systems and what actually works to stop them. Essential Eight is their distilled, practical guidance: eight strategies that, if properly implemented, stop the vast majority of cyber attacks.
It’s not theoretical. It’s based on years of observing actual attackers and what techniques are most effective.
The Eight Strategies Explained
1. Application whitelisting. Your business software runs approved applications. Application whitelisting restricts what programs can run on each device—only whitelisted applications are allowed. This stops malware that attackers try to install. In practice, this means your IT team manages which applications are permitted, and anything else is blocked. For SMEs, this is often implemented via Group Policy (Windows) or mobile device management (MDM) for phones and tablets.
2. Patch applications. Software has vulnerabilities. Attackers exploit them. When software vendors release patches, apply them immediately. This includes Windows, Office, browsers, Adobe, Java, and third-party applications. For larger organisations, patch management is automated and enforced. For SMEs, it often means ensuring Windows Update runs, setting critical applications to auto-update, and regularly checking for updates to software vendors that don’t auto-patch.
3. Configure Microsoft Office macro settings. Office macros are powerful—they let documents do things beyond just displaying text. Attackers use malicious macros to compromise computers. The strategy: disable macros by default, only enable for trusted sources, and educate users to be suspicious of unexpected macro prompts. Most organisations block all macros or restrict them to digitally signed documents.
4. User application hardening. Configure applications securely. For web browsers, this means disabling plugins, enabling security features, and restricting what can run. For PDF readers, Office, and other applications, disable features that aren’t essential but could be exploited. It’s preventative: remove attack surface before attackers can exploit it.
5. Restrict administrative privileges. Too many users run computers as administrators. If they accidentally run malware, it has full system access. The strategy: most users run with limited permissions; only when they need to install something or make system changes do they elevate to admin (and only for that specific action). This limits the damage a compromised account can do.
6. Patch operating systems. Similar to application patching, but specifically Windows and macOS updates. These patches often fix critical security vulnerabilities. Many organisations enforce automatic patching and require devices to be patched before they can connect to corporate networks.
7. Multi-factor authentication (MFA). Your password alone isn’t enough. MFA requires a second factor—a code from an authenticator app, a security key, or a biometric. Even if someone steals your password, they can’t access your account without the second factor. MFA is essential for email, cloud services, and administrative accounts. The ASD recommends MFA for all privileged accounts and high-value systems.
8. Regular backups. Even with all the above, incidents happen. Regular automated backups ensure you can recover if ransomware hits, data is lost, or systems are compromised. The ASD recommends backups follow the 3-2-1 rule: three copies of data, on at least two different media types, with one copy offline or geographically separate.
Essential Eight Maturity Levels
Compliance with Essential Eight is measured in maturity levels, from Level 1 (basic implementation) to Level 3 (comprehensive, mature implementation).
Level 1: Essential practices. You’ve implemented the eight strategies in their basic form. Patches are applied regularly. MFA is enabled for critical accounts. Backups are automated. Application whitelisting is configured, though perhaps not perfectly. This is the minimum for organisations handling sensitive data.
Level 2: Advanced implementation. You’re using mature, well-tested solutions. Patch management is automated and enforced. Application whitelisting is strictly configured and regularly reviewed. MFA is enforced for all users, not just admins. Backups are tested regularly. You have visibility into security across systems and handle incidents promptly.
Level 3: Mature, optimised approach. This is enterprise-grade. Automated enforcement of all eight strategies. Comprehensive logging and monitoring. Regular testing and improvement. Incident response plans are tested regularly. Security is integrated into all business processes.
Most Australian government contracts require Level 1 or Level 2 maturity. Large organisations often target Level 2–3. For SMEs, Level 1 is typically sufficient and achievable.
What Does Level 1 Compliance Look Like for an SME?
Don’t be intimidated by the language. Level 1 compliance for a small business is practical and achievable:
Application whitelisting. You maintain a list of approved applications. Users can run those. Anything else is blocked. In practice, this might mean configuring Windows AppLocker or using MDM tools for mobile devices. For a 20-person office, you might whitelist Word, Excel, Outlook, your accounting software, your CRM, your web browser, and perhaps 5–10 other applications. That’s it.
Patch management. Windows Update is enabled and set to auto-install critical patches. Your key applications (Office, browsers, Adobe, accounting software) are set to auto-update. You have a process to identify and patch applications that don’t auto-update. Every quarter, your IT person (or MSP) reviews what’s running and checks for available patches.
Office macro settings. Macros are disabled by default in Office. If you receive a document with macros, Office warns you, and you only enable them if you trust the source. This is relatively painless because most modern documents don’t use macros.
User application hardening. Your web browsers have plugins disabled. Adobe Reader is configured to not run JavaScript. Office is set to restrict suspicious content. These are relatively standard configurations.
Administrative privileges. Most users on standard user accounts. Administrators have separate admin accounts used only when necessary. When a developer needs to install a tool, they do it themselves with their admin account, then switch back to user account. This is a discipline, but it’s not technically difficult.
Operating system patching. Windows Update is mandatory. You have a process to ensure devices are patched within a reasonable timeframe. Some organisations require patching within 30 days of release; others within 14 days for critical patches.
Multi-factor authentication. You’ve enabled MFA for your cloud services (Microsoft 365, cloud storage, accounting software). Your admin accounts and email have MFA enforced. For a small organisation, this might be 5–10 accounts with MFA. Users log in with password plus a code from an authenticator app.
Backups. You have automated backups running daily. You backup to both local storage and cloud storage (following the 3-2-1 principle). You test restore procedures quarterly—actually restore a file, verify it works, confirm the process. You have an offline backup (disconnected from the network) in case of ransomware.
That’s Level 1. It’s not overly complex, but it requires planning, discipline, and maintenance.
Why Essential Eight Matters
Government contracts and compliance. If you do business with Australian government, or if you’re pursuing contracts that require it, Essential Eight compliance is mandatory. Government buyers now assume this as baseline security.
Insurance and liability. Cyber insurance policies often reference Essential Eight. Some insurers require Level 1–2 compliance before providing coverage. Others offer better rates to organisations demonstrating Essential Eight maturity.
Practical protection. Essential Eight isn’t theoretical. It’s based on actual threat intelligence from the ASD. Implementation of these eight strategies prevents the majority of cyber attacks. You’re not complying with bureaucratic requirements—you’re actually protecting your business.
Customer confidence. If your customers are large organisations or government agencies, they’ll ask about your cybersecurity. “We meet Essential Eight Level 1” is a credible answer. “We have some security” is not.
Getting to Level 1 Compliance
If you’re not currently compliant, here’s a practical path forward:
Assessment (week 1). Document your current state: what security tools do you have, what patches are applied, do you have backups, is MFA enabled. Identify gaps against Essential Eight.
Prioritise (week 2). All eight strategies matter, but some are more urgent. If you have no backups, that’s critical. If your email doesn’t have MFA, that’s high-priority. If your Word macros are enabled by default, that’s medium priority.
Implement (weeks 3–8). Roll out changes systematically. Test before full deployment. Communicate with users—particularly if you’re restricting administrator access or disabling macros. Some changes (like MFA) need user training.
Maintain (ongoing). Essential Eight compliance isn’t a one-time project. It requires ongoing patch management, backup testing, and monitoring. Build these into regular IT operations.
Working With an MSP for Essential Eight Compliance
Many organisations partner with a managed IT provider to achieve and maintain Essential Eight compliance. An experienced MSP can:
Assess your current environment against Essential Eight standards and identify gaps.
Create a remediation plan with timelines and priorities.
Implement the technical controls—configuring Windows security, deploying MFA, setting up application whitelisting.
Manage ongoing maintenance: patch management, backup testing, monitoring for compliance.
Provide documentation and evidence of compliance for insurance or contract requirements.
This is far simpler and lower-cost than trying to build this capability in-house.
The Bottom Line
Essential Eight is no longer optional for Australian businesses. Government contracts, insurance requirements, and good security practice all point toward implementing it. For SMEs, Level 1 compliance is achievable without enormous cost or complexity. It requires planning, discipline, and ongoing maintenance, but it genuinely protects your business.
If you’re unsure whether you’re Essential Eight compliant or want to work toward compliance, we can help. We work with Australian SMEs daily to implement and maintain Essential Eight standards. Talk to us about your specific situation or call 1300 028 324.
