The Essential Eight: where a small business should start.

The Essential Eight is a list of eight security controls published by the Australian Signals Directorate (ASD). It was written for organisations that run Microsoft Windows networks, and it has become the baseline that government buyers, insurers and larger customers in Australia tend to ask about.

It is not law for most private businesses, and there is no official certificate. It is the most widely agreed answer in Australia to a practical question: what should we do first?

The eight controls

• Patch applications. Install security updates for browsers, office software, PDF readers and anything else that opens files from the internet.
• Patch operating systems. Keep Windows, macOS and server systems updated, and replace versions the maker no longer supports.
• Multi-factor authentication. Ask for a second proof of identity at sign-in, starting with email, remote access and administrator accounts.
• Restrict administrative privileges. Give administrator rights only to the people who need them, on separate accounts that are not used for email or browsing.
• Application control. Allow only approved programs to run, so an unknown file from an email cannot.
• Restrict Microsoft Office macros. Block macros that come from the internet, and allow them only where the business depends on them.
• User application hardening. Switch off the features attackers rely on, such as web advertisements and Java in browsers.
• Regular backups. Back up important data, software and settings, keep the copies safe, and test that they restore.

Maturity levels, briefly

ASD describes four maturity levels, from Zero to Three. Level Zero means there are weaknesses. Levels One to Three are built to withstand attackers of increasing skill and determination. Level One is aimed at attackers who use widely available tools against any target they can find, which describes most of what a small business faces.

ASD’s advice is to reach the same level across all eight controls before moving higher. The controls are designed to work together, and an attacker only needs the one that was left open.

A sensible order for a small business

All eight matter, but they do not cost the same or take the same time. This order suits most offices of five to fifty people.

1. Multi-factor authentication on email and anything that can be reached from the internet. It is quick, and it blocks the most common way in.
2. Automatic updates for operating systems, browsers and office software, plus a check that they are really being installed.
3. Backups that are tested, with one copy that ransomware cannot reach.
4. Administrator rights removed from everyday accounts.
5. Macros blocked for everyone who does not need them, and browsers tightened.
6. Application control, which takes the most planning and usually comes last.

What it does not cover

The Essential Eight is about technical controls. It says little about people, suppliers or what to do when something goes wrong. A business also needs staff who know how to spot a phishing email, a plan for the day an incident happens, and an understanding of its duties under the Notifiable Data Breaches scheme if it is covered by the Privacy Act.

ASD also publishes a handbook written for small businesses. It is a good companion to the full model, and both are linked below.

Measuring where you stand against the Essential Eight, and closing the gaps in order, is what our Essential Eight service does.