The Essential Eight, published by the Australian Cyber Security Centre, is among the more practical frameworks available because it is prescriptive rather than aspirational: it names specific strategies and defines what each looks like at increasing levels of rigour.

The eight strategies

  • Application control — only approved applications execute.
  • Patch applications — particularly internet-facing ones, on defined timescales.
  • Configure Microsoft Office macro settings — block macros from the internet.
  • User application hardening — disable unnecessary features in browsers and office suites.
  • Restrict administrative privileges — limit, review, and separate admin accounts.
  • Patch operating systems — the same discipline applied to the OS layer.
  • Multi-factor authentication — on remote access and important systems.
  • Regular backups — performed, retained, and tested for restoration.

Maturity levels

Each strategy is assessed from Level Zero to Level Three, where higher levels address progressively more capable adversaries. For a small business without a security team, Level One across all eight is a sensible and achievable target, and considerably better than Level Three on two strategies and nothing on the rest.

Where the effort concentrates

Patching and administrative privilege restriction typically require the most ongoing discipline. Application control is the strategy most organisations struggle with, because it demands knowing what legitimately runs in your environment — which is precisely why it is effective, and why partial implementation delivers little.

Why it is worth using even if not required

It is specific enough to act on, sequenced by effectiveness, and maps cleanly to the attacks that actually occur. Where a general framework leaves you deciding what to do, the Essential Eight tells you — which is exactly what an organisation without dedicated security staff needs.

What it does not address

Incident response, staff awareness, supplier risk, physical security, and the procedural controls that prevent payment fraud. The Eight is a technical baseline. Business email compromise, the most likely large loss for a small business, is barely touched by it — so pair it with the verification rules that address that specifically.