The Essential Eight, translated for a 20-person Australian business
The Essential Eight keeps appearing in insurance questionnaires, tender documents and client security reviews. It was written by the Australian Signals Directorate for federal entities, which is why reading it cold feels like being handed someone else's homework. The underlying logic still applies to a 20-person business — it just needs translating.
The eight, in business language
- Application control — only approved software runs
- Patch applications — browsers, Office, PDF readers kept current
- Configure Office macro settings — block macros from the internet
- User application hardening — disable the risky bits of browsers and Office
- Restrict administrative privileges — few admins, used deliberately
- Patch operating systems — laptops and servers kept current
- Multi-factor authentication — proof beyond a password
- Regular backups — tested restores, not just backup jobs
Which ones your email tenant decides
Three of the eight are largely settled inside Microsoft 365 or Google Workspace: multi-factor authentication, restricting administrative privileges, and a meaningful chunk of user application hardening. That's the fastest, cheapest ground to cover, and it's also the ground attackers use most.
Backups are the fourth one people get wrong in a cloud tenant. Microsoft and Google protect their infrastructure, not your retention policy — a deleted or maliciously purged mailbox is your problem, and 'the cloud backs it up' is not an answer an assessor accepts.
What Maturity Level One really asks
Maturity Level One is described as mitigating adversaries using commodity tradecraft — phishing kits, credential stuffing, off-the-shelf malware. That is precisely the threat profile of an Australian SMB. You do not need Level Two or Three to be defensible; you need Level One to be genuine rather than aspirational.
The practical test is evidence. Not 'we have MFA' but 'here is the report showing 34 of 34 accounts enforced, with no exclusions'.
Where the Privacy Act is heading
The long-standing small-business exemption under the Privacy Act is on the reform agenda, and the direction of travel is clear: fewer businesses exempt, more expected to demonstrate reasonable security steps. Businesses that already hold tax file numbers, health information or credit data are typically caught regardless of turnover.
Start where the controls overlap with your email tenant. It's the cheapest maturity you will ever buy, and it's the part an insurer or client is most likely to ask you to evidence.
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
