← Back to blog

The ASD Essential Eight: A Practical Cybersecurity Guide for Australian SMEs

The ASD Essential Eight is becoming the de facto cybersecurity standard for Australian businesses. Here's what it means and how to implement it without an in-house security team.

The Australian Signals Directorate’s Essential Eight Maturity Model has moved from a government-focused framework to the default cybersecurity standard across Australian enterprise and now SME markets.

What is the Essential Eight?

Eight baseline security controls defined by ASD as the minimum required to mitigate the most common cyber threats: (1) Application control, (2) Patch applications, (3) Configure Microsoft Office macro settings, (4) User application hardening, (5) Restrict administrative privileges, (6) Patch operating systems, (7) Multi-factor authentication, (8) Regular backups. Each control has four maturity levels (0-3). Most businesses should target Maturity Level 2.

Why It Matters Commercially

The Essential Eight matters for three commercial reasons today: government contracts increasingly require Maturity Level 2 as a minimum; cyber insurance underwriters are incorporating Essential Eight into risk assessments with premium implications; and supply chain security requirements from larger businesses are cascading to their SME suppliers. If none of these apply today, they will within 2-3 years.

The Quick Wins — Start Here

Highest-impact, lowest-effort controls: MFA — enforce on every external-facing system immediately. Patch management — patch applications and operating systems within 48 hours of a critical vulnerability disclosure. Restrict administrative privileges — ensure users don’t have local admin rights on workstations. These three controls address the vast majority of successful cyberattacks and can be implemented within 30 days.

The Common Compliance Gaps

Controls SMEs most commonly fail to implement correctly: application control (whitelisting what software can run is technically complex and operationally disruptive if implemented poorly); user application hardening (disabling browser features requires ongoing maintenance as browser versions update); and backup verification (having backups is necessary but not sufficient — you must regularly test restoration from backup).

The Cost of Getting It Wrong

The Australian Cyber Security Centre reported average costs of cyber incidents for Australian SMEs in 2024: $46,000 for small businesses, $97,000 for medium businesses. This excludes reputational damage, Notifiable Data Breach notification obligations, and potential OAIC enforcement action. Implementing Essential Eight Maturity Level 2 for an SME typically costs $15,000-$40,000. The risk-adjusted decision is straightforward.


Ready for senior technology leadership? View our plans from $1,000/month AUD, or book a free 45-minute discovery call.

KA
in Connect on LinkedIn
The CTO Brief

Get the next one in your inbox

One sharp idea on technology leadership, every fortnight. No spam.

Keep reading
Tech Strategy

Multi-Tenancy Done Right: Isolation, Security and Scale for SaaS

3 min read
Tech Strategy

ISO 27001 for Australian SaaS: Is It Worth It, and When?

2 min read
Tech Strategy

Key-Person Risk: Spotting and Removing Single Points of Failure in Your Tech

3 min read
Free 45-minute discovery call

Want this thinking applied to your business?

Book a free call with Ken and get a senior, honest read on your technology.

Sister brand: CISO Advisory Australia — independent cyber security & Virtual CISO services