Essential Eight Compliance for Melbourne Small Business

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate through the Australian Cyber Security Centre. It exists because a small number of controls prevent a disproportionate share of real-world compromises, and it is the closest thing Australia has to a baseline that a small business can actually be measured against.

The eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups.

Listing them is the easy part, and it is where most coverage stops. What matters commercially is the maturity model that sits underneath, and whether the controls are actually configured in your environment rather than nominally available in your licensing.

The Essential Eight Maturity Model runs from Level Zero to Level Three. It is not a score out of eight. You are assessed against each strategy, and your overall maturity is limited by your weakest one.

This is the most useful thing a small business can learn about the Essential Eight: a substantial part of Level One is achievable with Microsoft 365 licensing you may already be paying for, and simply have not configured.

• Multi-factor authentication is available on every Microsoft 365 plan and is the single highest-value control on the list
• Office macro settings can be centrally enforced rather than left to each user
• User application hardening, including browser and Office attack-surface settings, can be pushed by policy
• Administrative privilege restriction starts with separating day-to-day accounts from admin accounts, which costs nothing
• Patch status for both operating systems and applications can be reported and enforced centrally

What Microsoft 365 does not give you on its own is application control, verified and tested backups, or the discipline of actually checking any of it on an ongoing basis. Those are the parts that need a provider or an internal owner.

The eight strategies are not equally difficult and they are not equally urgent for a small office. We work in the order that removes the most risk for the least disruption.

• First: multi-factor authentication across all accounts, and separating administrative accounts from daily-use accounts
• Second: operating system and application patching brought under central control and monitored
• Third: backups verified and restore-tested, not merely scheduled
• Fourth: Office macro settings and user application hardening enforced by policy
• Fifth: administrative privilege review, removing standing local admin rights from staff devices
• Last: application control, which is the most disruptive to implement and is usually sequenced once the rest is stable

For a typical 10 to 25 person Melbourne office, the first three items address the great majority of realistic risk and can generally be put in place without changing how anyone works.

Essential Eight questions used to arrive only from government and enterprise procurement. That has changed. Cyber insurance applications now ask about multi-factor authentication and backups directly, and enterprise clients increasingly push security requirements down their supply chain to firms far smaller than themselves.

A documented assessment is worth having before you are asked for one, because the answer to a tender question is much easier to give when you already know it.

We review your environment against each of the eight strategies, establish the maturity level you are genuinely at today, and give you a written summary with a prioritised order of work and what each item involves. You keep that document regardless of whether we do the implementation.

If you would rather understand the framework in depth before booking anything, our plain-English Essential Eight guide covers each of the eight strategies and what they mean for a small business.