For an Australian small business, Essential 8 compliance means implementing the Australian Signals Directorate's eight baseline cyber security mitigation strategies at a maturity level that matches the threats you face. Most small businesses start at Maturity Level One — the level built to stop commodity attackers who use phishing emails, stolen credentials and unpatched software against any victim they can find.
What the Essential Eight actually covers
The Essential Eight pulls the eight most effective strategies out of ASD's wider Strategies to Mitigate Cyber Security Incidents framework. At Maturity Level One they break down like this:
- Application control — only an approved set of programs can run on your workstations, blocking malicious executables outright.
- Patch applications — browsers, office suites, email clients and PDF software get security patches within two weeks; critical vulnerabilities with working exploits within 48 hours.
- Patch operating systems — the same patching discipline applied to internet-facing systems, then workstations within a month.
- Multi-factor authentication — MFA on your organisation's online services that process sensitive data.
- Restrict administrative privileges — staff work from unprivileged accounts, so a compromised login cannot reconfigure the network.
- Restrict Microsoft Office macros — macros in files from the internet are blocked, killing a classic malware delivery route.
- User application hardening — web browsers and office applications are hardened so internet content cannot run amok.
- Regular backups — backups are retained securely and, critically, restoration is actually tested.
ASD keeps the current control lists in its Essential Eight maturity model, first published in June 2017 and last updated in November 2023.
Compliance means hitting a maturity level
Essential 8 compliance is not a checkbox or a certificate — it is a maturity level. The model defines four:
- Maturity Level Zero (ML0): weaknesses in your overall posture that a commodity attacker could exploit. If you are assessed at ML0, you have gaps at ML1.
- Maturity Level One (ML1): defends against commodity tradecraft — opportunistic phishing, credential reuse, unpatched software. ASD's own guidance suggests ML1 is generally suitable for small to medium enterprises.
- Maturity Level Two (ML2): defends against attackers who invest more time and craft more convincing phishing. Commonwealth entities have been required to implement the Essential Eight to at least ML2 under the Australian Government's Protective Security Policy Framework since 1 July 2022.
- Maturity Level Three (ML3): defends against adaptive actors using more sophisticated techniques. Mainly for critical infrastructure and high-threat environments.
Two things surprise small business owners here. First, ASD states there is no requirement for independent certification — implementations only need independent assessment where a contract, regulator or government directive demands it. Second, you must reach the same maturity level across all eight strategies; fixing seven strategies to ML1 while ignoring backups still leaves you short. That is by design — the eight complement each other.
Where small businesses actually fail: the human layer
Read the ML1 threat model again: malicious actors employ common social engineering techniques to trick users into weakening the security of a system. The attacker's favourite exploit is not a zero-day — it is a staff member.
Technical controls cannot stop an employee entering credentials into a convincing ATO tax-refund page or approving a fake invoice. That is where the human layer carries its weight: security awareness training and phishing simulations harden exactly the target the attacker goes after, and they are the easiest part of the Essential Eight to evidence, because every completed course and every reported email is logged per learner.
A realistic 90-day path
A small business without a dedicated security team can make real ML1 progress in one quarter. The sequence matters — assess first, fix second, prove third.
Weeks 1–2: Run a gap assessment
Start with a structured cyber security gap assessment rather than a self-graded spreadsheet. A framework-mapped assessment tells you which of the eight strategies sit at ML0 and which already meet ML1, and produces a prioritised list a non-technical manager can read. Re-run it annually and after major changes.
Weeks 3–6: Bank the technical quick wins
- Turn on MFA everywhere it is available — email, accounting, remote access — before touching anything else.
- Confirm automatic patching is on for operating systems and the big application families: browsers, office suites, email clients, PDF software.
- Check that backups run daily and, above all, that a restore has been tested in the last 12 months.
- Strip admin rights from day-to-day accounts.
These moves address half the eight strategies and remove the failure modes behind most commodity incidents.
Weeks 4 onward: Start monthly awareness training
Deploy security awareness training as short, recurring lessons rather than one annual marathon. Story-driven modules that dramatise real attacks — invoice fraud, credential harvesting, tax-refund scams — stick far better than policy slide decks. Assign a baseline set in month one, then add one topic per month.
Weeks 6 onward: Phish your own staff
Launch phishing simulations on a steady monthly cadence. The point is not to catch people out — it is to give every clicker a same-day coaching moment and every reporter positive reinforcement. Platforms that auto-enrol anyone who clicks into a remediation course turn each campaign into training without admin overhead.
Ongoing: Evidence and reporting
From month two, track per-learner human risk reporting: overdue courses, quiz results and phishing outcomes rolled into one score. When a client, insurer or assessor asks how you manage the human element of the Essential Eight, you will have dated, per-person evidence instead of an attendance sheet.
What it costs
Costs vary with how much you outsource. The drivers are an initial assessment, remediation work for the technical strategies — much of it configuration rather than new spending — and a training platform priced per seat. Most small businesses find the training layer is the smallest line item in the programme, and the one that stops the incidents the other seven strategies assume will get through.
FAQ
Is Essential 8 compliance mandatory for small business? No. The Essential Eight is mandated at ML2 for Commonwealth entities, but private businesses adopt it voluntarily — usually to win contracts, satisfy insurers or cut incident risk. It remains the most widely recognised Australian baseline.
What maturity level should a small business target? Maturity Level One. ASD's guidance suggests ML1 generally suits small to medium enterprises, ML2 large enterprises and ML3 high-threat environments.
Do we need to be certified? No. ASD notes there is no requirement for independent certification; assessment only applies where a contract or regulator requires it. Evidence — reports, logs, training records — is what gets checked.
How long does Essential 8 compliance take? A focused small business can make substantial ML1 progress in about 90 days: assessment in weeks one and two, technical fixes by week six, and the training and phishing cadence running from month two onward.
Where does staff training fit into the Essential Eight? The eight strategies are technical, but the ML1 threat model is social engineering. Awareness training and phishing simulations defend the human layer the model assumes attackers will target, and produce the per-user evidence assessors want.
How often should we reassess? Annually is the common rhythm, plus after major changes such as a new system or office move. Continuous reporting turns each reassessment into a formality instead of a project.
One last thing
The eight strategies fail as a set, not individually. A business with flawless patching but no tested backups, or perfect MFA but a staff body that clicks every invoice email, is still one incident away from a bad month. Assess all eight, then close the human gap with the same monthly discipline you give patching.