The Australian Signals Directorate’s Essential Eight Maturity Model has moved from a government-focused framework to the default cybersecurity standard across Australian enterprise and now SME markets.
What is the Essential Eight?
Eight baseline security controls defined by ASD as the minimum required to mitigate the most common cyber threats: (1) Application control, (2) Patch applications, (3) Configure Microsoft Office macro settings, (4) User application hardening, (5) Restrict administrative privileges, (6) Patch operating systems, (7) Multi-factor authentication, (8) Regular backups. Each control has four maturity levels (0-3). Most businesses should target Maturity Level 2.
Why It Matters Commercially
The Essential Eight matters for three commercial reasons today: government contracts increasingly require Maturity Level 2 as a minimum; cyber insurance underwriters are incorporating Essential Eight into risk assessments with premium implications; and supply chain security requirements from larger businesses are cascading to their SME suppliers. If none of these apply today, they will within 2-3 years.
The Quick Wins — Start Here
Highest-impact, lowest-effort controls: MFA — enforce on every external-facing system immediately. Patch management — patch applications and operating systems within 48 hours of a critical vulnerability disclosure. Restrict administrative privileges — ensure users don’t have local admin rights on workstations. These three controls address the vast majority of successful cyberattacks and can be implemented within 30 days.
The Common Compliance Gaps
Controls SMEs most commonly fail to implement correctly: application control (whitelisting what software can run is technically complex and operationally disruptive if implemented poorly); user application hardening (disabling browser features requires ongoing maintenance as browser versions update); and backup verification (having backups is necessary but not sufficient — you must regularly test restoration from backup).
The Cost of Getting It Wrong
The Australian Cyber Security Centre reported average costs of cyber incidents for Australian SMEs in 2024: $46,000 for small businesses, $97,000 for medium businesses. This excludes reputational damage, Notifiable Data Breach notification obligations, and potential OAIC enforcement action. Implementing Essential Eight Maturity Level 2 for an SME typically costs $15,000-$40,000. The risk-adjusted decision is straightforward.
Ready for senior technology leadership? View our plans from $1,000/month AUD, or book a free 45-minute discovery call.