How the Essential Eight works

If you've been asked about the Essential Eight by an insurer, a client or a tender, you're not alone. It's become the standard yardstick for cyber security in Australian businesses. Here's what it actually is.

A checklist from the ACSC

The Essential Eight is a set of eight security strategies published by the Australian Cyber Security Centre (ACSC). Think of it as a checklist for keeping attackers out. It's practical, prioritised and designed around how real attacks happen.

The eight fall into three groups.

1. Stop attacks getting in

• Application control. Only approved software can run, so malicious programs can't launch.
• Patch applications. Keep browsers, Office, PDF readers and other apps up to date.
• Configure Microsoft Office macros. Block macros from the internet, a common way malware arrives.
• User application hardening. Switch off features attackers abuse, such as old browser plugins.

2. Limit the damage

If something does get in, these stop it spreading.

• Restrict admin privileges. Few people have admin rights, and only use them when needed.
• Patch operating systems. Keep Windows, macOS and servers current.
• Multi-factor authentication. A stolen password alone isn't enough.

3. Recover

• Regular backups. Tested, protected backups so you can get back up and running.

Maturity levels

Each strategy is measured on a maturity level from zero to three.

• Level 0: not really in place
• Level 1: protects against basic, opportunistic attacks
• Level 2: protects against more determined attackers
• Level 3: protects against skilled, targeted attackers

You don't need to hit level three across the board. For most small and medium businesses, reaching level one, then level two, is a sensible goal. The value is in seeing where you stand and knowing what to improve next.

Why it matters now

More and more cyber insurers are asking about the Essential Eight before quoting or renewing. Larger clients and government agencies are asking suppliers too. Being able to show where you stand, and a plan to improve, is increasingly part of doing business.

Where to start

Many businesses are closer than they think. MFA, patching and backups alone cover a lot of ground. The trick is knowing which gaps matter most for your setup.

Find out where you stand

Our free Essential Eight assessment takes about three minutes and shows you where you stand on each strategy. You'll find it with our other useful free tools at nexcentric.com.au/tools. If you'd like help closing the gaps, Nexcentric can build a practical roadmap.