The Essential Eight, translated for a 20-person Australian business
▶ Watch the short explainer for this tip
The Essential Eight keeps appearing in insurance questionnaires, tender documents and client security reviews. It was written by the Australian Signals Directorate for federal entities, which is why reading it cold feels like being handed someone else's homework. The underlying logic still applies to a 20-person business — it just needs translating.
The eight, in business language
- Application control — only approved software runs
- Patch applications — browsers, Office, PDF readers kept current
- Configure Office macro settings — block macros from the internet
- User application hardening — disable the risky bits of browsers and Office
- Restrict administrative privileges — few admins, used deliberately
- Patch operating systems — laptops and servers kept current
- Multi-factor authentication — proof beyond a password
- Regular backups — tested restores, not just backup jobs
Which ones your email tenant decides
Three of the eight are largely settled inside Microsoft 365 or Google Workspace: multi-factor authentication, restricting administrative privileges, and a meaningful chunk of user application hardening. That's the fastest, cheapest ground to cover, and it's also the ground attackers use most.
Backups are the fourth one people get wrong in a cloud tenant. Microsoft and Google protect their infrastructure, not your retention policy — a deleted or maliciously purged mailbox is your problem, and 'the cloud backs it up' is not an answer an assessor accepts.
What Maturity Level One really asks
Maturity Level One is described as mitigating adversaries using commodity tradecraft — phishing kits, credential stuffing, off-the-shelf malware. That is precisely the threat profile of an Australian SMB. You do not need Level Two or Three to be defensible; you need Level One to be genuine rather than aspirational.
The practical test is evidence. Not 'we have MFA' but 'here is the report showing 34 of 34 accounts enforced, with no exclusions'.
Where the Privacy Act is heading
The long-standing small-business exemption under the Privacy Act is on the reform agenda, and the direction of travel is clear: fewer businesses exempt, more expected to demonstrate reasonable security steps. Businesses that already hold tax file numbers, health information or credit data are typically caught regardless of turnover.
Start where the controls overlap with your email tenant. It's the cheapest maturity you will ever buy, and it's the part an insurer or client is most likely to ask you to evidence.
Frequently asked questions
- Is the Essential Eight mandatory for private businesses?
- It is mandatory for most Commonwealth entities, not for private SMBs. It is increasingly used as the benchmark in insurance questionnaires, tenders and client security reviews, which is why it matters commercially.
- What maturity level should a 20-person business aim for?
- Maturity Level One is a realistic and defensible target for most SMBs. Level Two is worth it if you hold sensitive client data or a contract requires it.
- Does Microsoft 365 cover the Essential Eight on its own?
- It covers a good portion — MFA, application control inputs, patching signals and admin restrictions — but only when configured. The default tenant settings do not reach Maturity Level One.
- How do we prove our maturity level to an insurer or client?
- With dated evidence of your configuration. The audit report is written for exactly that purpose and can be handed straight to an insurer, auditor or client.
Sources
Every reference below was link-checked when this article was published.
- 1.Essential Eight Maturity ModelAustralian Signals Directorate — ACSC
- 2.Small Business Cyber Security GuideAustralian Signals Directorate — ACSC
- 3.Implementing Multi-Factor AuthenticationAustralian Signals Directorate — ACSC
- 4.Security defaults in Microsoft Entra IDMicrosoft Learn
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
