Everything You Need to Know About the Essential Eight
Think cybersecurity is something only big companies need to worry about? Think again. Every business, big or small, is a target. And if you’re not proactive, you’re putting everything—your data, your customers, your future—at risk!
The Essential Eight isn’t just another overly complicated IT strategy. It’s a set of powerful, no-nonsense steps your business can take to strengthen its defence against cyber threats, all without blowing your budget.
Why Should You Care About the Essential Eight?
Because attacks are getting smarter every single day. Sitting back and hoping it won’t happen to you isn’t just risky; it’s reckless. The Essential Eight flips the script, taking your business from being a sitting duck to a fortified fortress.
What Is the Essential Eight?
Introduced in 2017, the Essential Eight is designed to stop threats before they even start. It gives you eight simple, practical strategies to not only shield your business but also recover fast in case of an attack.
Here’s the Breakdown:
Application Control – Only allow trusted apps to run. No exceptions.
Patch Applications – Update, update, update—and do it fast.
Configure Macro Settings – Block dangerous macros in tools like Microsoft Office.
User Application Hardening – Turn off outdated features hackers love, like Flash.
Restrict Administration Privileges – Admin access is gold—don’t give it to just anyone. Limit admin access to only the people who absolutely need it
Patch Operating Systems – Fix operating system vulnerabilities before attackers find them.
Multi-Factor Authentication (MFA) – Make it harder for hackers to break in with MFA (add link to article The Importance of Multifactor Authentication).
Daily Backups – Back up your data every day. No excuses.
The best part? The first four steps actively block attacks, while the rest minimise damage if something slips through the cracks. Simple, powerful, and designed to work in real businesses.
Here’s an introductory checklist to guide you on how to apply this in your business:
THE ESSENTIAL EIGHT SECURITY CHECKLIST
Stay safe and protect your business—copy this checklist and tackle one section at a time for easy, steady progress!
✅ Control Applications
Allow Only Approved Apps: Ensure only trusted and approved applications can run on your systems.
Regular Reviews: Review and update your list of approved applications routinely.
✅ Update Applications
Quick Updates: Install security updates for applications within two days of release.
Latest Versions: Use the latest versions of applications to prevent vulnerabilities.
✅ Macro Settings
Block Risky Macros: Disable macros from the internet in Microsoft Office.
Trusted Sources Only: Only allow macros from trusted locations with limited write access.
✅ Harden Applications
Disable Unnecessary Features: Turn off features you don’t need, like Flash and Java.
Block Ads and Extensions: Block web advertisements and limit browser extensions to reduce risks.
✅ Limit Admin Access
Restrict Admin Privileges: Only provide administrative privileges to those who absolutely need them.
Regular Audits: Regularly review and remove unnecessary admin accounts.
✅ Update Operating Systems
Timely Updates: Apply operating system security updates within two days of their release.
Use Latest OS Versions: Use the most current versions of operating systems to stay secure.
✅ Use Multi-Factor Authentication (MFA)
MFA for Remote Access: Enable multi-factor authentication for remote access and privileged accounts.
Critical Systems: Apply MFA when accessing critical systems and sensitive data
✅ Daily Backups
Regular Backups: Back up your important data, applications, and configurations daily.
Secure Storage: Store backups offline or on a separate network for ransomware protection.
Why Small and Medium-Sized Businesses Can’t Ignore This
Think hackers are only after giant companies? Wrong.
SME’s often operate with less money, technical expertise and often don’t have the resources to recover from an attack. That makes you an easy target.
Most businesses wait until it’s too late to act, running a “fix it after the fact” playbook. The Essential Eight flips that outdated approach, helping you stay ahead of threats instead of scrambling to react.
No IT Degree Required
This isn’t about hiring expensive tech experts. It’s about taking proactive, common-sense actions that make your business a less attractive target to hackers.
The Secret Weapon? The Maturity Model
Not sure where to start? The Essential Eight comes with a Maturity Model, which tells you what to do based on your current size and risk level.
The Levels of Maturity:
Level 0 (Incomplete): Bare minimum defences—this is dangerous territory.
Level 1 (Partially Aligned): Basic protection like antivirus apps and firewalls. Too many businesses fall into Level 0 and Level 1.
Level 2 (Mostly Aligned): Filling the gaps with measures like MFA and OS patches. Achieving Maturity Level 2 is a solid goal for any sized business.
Level 3 (Fully Aligned): Advanced, robust measures for high-risk industries, often regulated markets such as finance or healthcare.
Where should you aim?
Small to Medium sized businesses: Level 1 is your minimum target
All businesses: Go for Level 2.
Critical industries: Level 3 is your safety net.
The takeaway: Pick a level, start now, and work your way up. Progress beats perfection every single time.
How to Put It into Action—Step by Step
It’s not about doing everything at once; it’s about easy, steady progress. Follow this actionable plan:
Assess Your Cyber Health
Figure out where you stand with a cybersecurity health check by using the Essential Eight Assessment Process Guide. Identify your biggest weak points.Create a Plan
Prioritise, assign tasks, and set clear deadlines. Make it easy to track progress.Implement the Strategies
Bit by bit, start integrating the Essential Eight into your daily operations.Track Progress
Monitor how well you’re doing and tweak the plan as needed. Cybersecurity is never static. Keep sharpening your defences as they evolve.Train Your Team
Your employees are your first line of defence. Regular training keeps them sharp and ready to spot potential risks.
Wrapping it up
Putting things off leaves your business wide open to threats. Start small, work on one strategy at a time, and you’ll see how each step makes your security stronger. The Essential Eight is all about making cybersecurity simple and doable for any business.
The longer you wait, the more chances hackers get to take advantage. Why risk it? Take that first step now and lock down your defences before it’s too late.
Do you want to learn more powerful ways to secure your business? Click this link to download our ebook for free.
ABOUT THE AUTHOR: JARROD RAMSAY
Jarrod’s entrepreneurial journey began at 19, reselling telco services for brands like Telstra, Vodafone and Vocus. Realising he wanted more, he sold his business and dove into Managed IT Services, launched a telco division and built a public cloud platform.
These bold moves weren't just about competition; they're about creating better solutions for his clients.
Today, Jarrod thrives on collaborating with business owners, sharing ideas, and tackling challenges with creative strategies. Whether you're an entrepreneur, a business owner, or an employee responsible for the ICT services at your business, feel free to reach out—he'd love to connect.