The Short Answer
Use The Essential Eight As A Prioritised Baseline, Not A Security Guarantee
The Australian Signals Directorate's Essential Eight covers application control, patching applications, restricting Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. A small business should first inventory devices, accounts, software and critical data, then implement the controls in stages according to exposure and consequence. No checklist guarantees prevention.
What Matters Most
- Know the devices, accounts, applications and data before measuring controls.
- Prioritise internet-facing and unsupported systems, privileged accounts and critical backups.
- Separate daily user accounts from administration and enable MFA on important services.
- Test restoration and record exceptions rather than assuming a green backup status is enough.
01
Establish A Visible Baseline
List computers, servers, network equipment, cloud services, public websites and administrators. Record supported versions, patch status, security agent, encryption and business owner.
Unsupported software and forgotten accounts deserve early attention because normal updates and access reviews may no longer protect them.
- Remove or replace unnecessary unsupported services.
- Apply operating-system and application updates promptly.
- Use standard accounts for normal work.
- Protect privileged and remote access with MFA.
- Restrict risky macros and unneeded browser features.
- Allow only approved applications where feasible.
02
Build Backup Around Recovery Scenarios
Identify what the business must recover: files, databases, email, cloud records, configuration and the keys or accounts needed to reach them. Keep an appropriately protected copy that a compromised everyday administrator cannot simply erase.
Test a representative restore and measure whether the recovered information is usable. A completed backup job is evidence of a copy, not evidence the whole business can recover.
| Area | Question |
|---|---|
| Scope | Which systems and cloud data are included? |
| Separation | Can an everyday compromised account delete every copy? |
| Frequency | How much recent work could be lost? |
| Restore | When was a real file or system tested? |
| Ownership | Who receives and acts on failures? |
03
Improve In Stages And Keep Evidence
The Essential Eight maturity model is risk-based and may require specialist interpretation. A smaller organisation can still benefit from the control areas without claiming a maturity level it has not assessed.
Ultra IT can review endpoints, Microsoft 365 or Google Workspace, website exposure and backups, then create a practical improvement sequence with owners and visible exceptions.
Common Questions
Clear Answers Before You Decide
What Are The Essential Eight Controls?
They are application control, patching applications, restricting Office macros, user application hardening, restricting admin privileges, patching operating systems, MFA and regular backups.
Does Following The Essential Eight Stop Every Attack?
No. The controls reduce common exposure when implemented and maintained, but no framework guarantees that an incident cannot occur.
Can A Small Business Use The Essential Eight?
Yes. The control areas provide a useful baseline, scaled to the systems and risks. Formal maturity assessment may need additional evidence and specialist advice.
Sources And Review Notes
This guide combines Ultra IT's practical service experience with the current primary sources below. Product availability, pricing and platform guidance can change; check the linked source or ask us to review the current environment before acting.
