Picture a small plumbing business in Western Sydney. There are five staff, one office manager called Sarah, and a laptop that holds every quote, invoice and customer address.
One Monday morning, Sarah opens an email that looks like it came from a supplier. She clicks the attached "invoice". Nothing seems to happen. The next morning, every file on the laptop is locked, and a message on the screen asks for $15,000 to get them back. The last backup was on a USB stick that has been plugged into the laptop for months, so it was locked too.
This story is made up, but cases like it happen to small Australian businesses all the time. The good news is that most of these attacks can be stopped with a few simple habits. The Australian Government has put those habits into a short list called the Essential Eight. This guide explains each one in plain words, so you can start protecting your business today.
What is the Essential Eight?
The Essential Eight is a list of eight simple steps that make it much harder for criminals to break into your business computers. It was created by the Australian Signals Directorate (ASD), the government agency that looks after cyber security, and was first released in 2017.
Think of it like looking after a shop. You lock the front door, keep the cash in a safe, don't give every worker the key to everything, and keep a copy of important papers at home in case of a fire. The Essential Eight does the same things for your computers, emails and files.
The eight steps sit in three groups:
- Stop attackers getting in (4 steps)
- Limit the damage if someone does get in (3 steps)
- Get back up and running fast (1 step)
A quick update: ASD has recently launched a new framework called ASD Essentials. According to Insurance Business, it is built mainly for government, critical infrastructure and large organisations. ASD is keeping the Essential Eight online during a transition period, and no changeover date has been set. For small businesses, ASD has also published a Small Business Cyber Security Handbook that focuses on four actions: multi-factor authentication, quick updates, regular backups and staff training. Three of those four are part of the Essential Eight, so everything below is still a very good place to start.
Why should a small business care?
Because criminals do not only go after big companies, and a cyber attack can cost a small business a lot of money. ASD's latest yearly report says the average cost of cybercrime for a small business was $56,600 per report, up 14% from the year before. It also says someone in Australia reports a cybercrime about every six minutes.
Most attacks are not clever. Criminals send thousands of fake emails and hope a few people click. They look for computers that have not been updated. They try passwords stolen from other websites. They go after whoever is easiest to reach, and a small business with no basic protection is easy.
Here are three common cases:
- The fake invoice. A staff member opens an email that looks like it is from a supplier. The attachment installs harmful software.
- The changed bank details. A criminal gets into your email and sends your customers a new bank account number. They pay the wrong person.
- The locked files. Ransomware locks all your files and demands money to open them.
The Essential Eight is designed to stop exactly these kinds of attacks.
Group 1: Stop attackers getting in
These four steps work like locks on your doors and windows.
1. Application control
What it means: Only programs you have approved can run on your computers. Anything else is blocked.
Example: Sarah gets an email with an "invoice" that is really a harmful program. With application control on, the laptop simply refuses to run it. Nothing happens, and the business carries on.
Easy first step: On Windows, tools such as Microsoft Defender Application Control or AppLocker can do this. Your IT support person can set it up.
2. Patch applications
What it means: "Patching" just means installing updates. Software makers fix security holes all the time. If you skip the updates, the holes stay open.
Example: A café owner keeps clicking "remind me later" on the update for the web browser on the shop computer. Months later, criminals use a hole that was fixed long ago to get in. One click on the update button would have stopped it.
Easy first step: Turn on automatic updates for your browser, PDF reader, Microsoft Office and other programs. ASD's guide says serious problems should be fixed within days, not months.
3. Configure Microsoft Office macro settings
What it means: A macro is a small program hidden inside a Word or Excel file. Criminals love to hide harmful macros in files that look normal.
Example: An accountant's office receives an Excel file called "Tax Refund.xlsm" from an unknown sender. If macros are blocked, the harmful part never runs.
Easy first step: Block macros in files that come from the internet. Most small businesses never need them.
4. User application hardening
What it means: Turn off risky features in the programs your staff use every day, such as web browsers and PDF readers.
Example: A staff member visits a website that has a harmful advert. If the browser blocks ads and risky content, the harm never reaches the computer.
Easy first step: Use a modern browser, turn on its safe browsing setting, and ask your IT person to switch off features you do not use.
Group 2: Limit the damage if someone gets in
No lock is perfect. These three steps make sure a small problem stays small.
5. Restrict administrator privileges
What it means: An "administrator" account can change anything on a computer. Only the people who really need that power should have it, and they should not use it for everyday work like reading email.
Example: A bakery owner uses the same all-powerful account to read emails and run the shop's computers. One bad click and the criminal has full control. If the owner used a normal account for daily work, the same click would do far less harm.
Easy first step: Make a separate admin account for updates and changes. Use a normal account for everything else.
6. Patch operating systems
What it means: This is the same idea as step 2, but for the main system of the computer, such as Windows, macOS or the system on your phones and servers.
Example: A small law firm still uses an old office computer that no longer gets updates. Criminals know the old weak spots and use them. Windows 10, for example, stopped getting free security updates in October 2025, so any computers still running it need a plan.
Easy first step: Turn on automatic system updates. Replace any computer that is too old to get them.
7. Multi-factor authentication (MFA)
What it means: A password alone is not enough. You also need a second proof that it is really you, such as a code from an app on your phone.
Example: A criminal buys a staff member's stolen email password online. Without MFA, they log straight in and start sending fake bank details to customers. With MFA, they are stuck at the second step, because they do not have the phone.
Easy first step: Turn on MFA for email, online banking, accounting software and cloud storage first. An authenticator app is safer than text messages. It takes about five minutes per account. Our step-by-step guide shows you how to set up MFA in 10 minutes.
Group 3: Get back up and running
8. Regular backups
What it means: Keep copies of your important files, and keep them somewhere an attacker cannot easily reach. Then check that you can really get the files back.
Example: Remember Sarah and the plumbing business? Their backup was a USB stick that stayed plugged into the laptop, so the criminals locked it too. Now imagine they had also kept a daily copy in a cloud backup service that the laptop could not change. They would restore their files in an afternoon and refuse to pay.
Easy first steps:
- Back up your important files every day, or at least every week.
- Keep at least one copy that is not always connected to your computer, such as a cloud backup with its own login.
- Once every few months, try to restore a file. A backup you have never tested may not work when you need it.
What are "maturity levels"?
Maturity levels show how well you have done each of the eight steps, and Level 1 is the right place for a small business to start. The Australian Government's small business site says the same, and points owners to ASD's small business cyber security guide.
| Level | What it means in plain words |
|---|---|
| Level 0 | There are real gaps. Many easy attacks would work. |
| Level 1 | You can stop common, low-effort attacks, like fake emails and unpatched software. |
| Level 2 | You can also stop criminals who put in a bit more effort and skill. |
| Level 3 | You can stop skilled criminals who keep changing their tricks. |
You do not need to be perfect on day one. Getting all eight steps to Level 1 will put you ahead of many small businesses. You can improve later, for example if an insurer, a big customer or the government asks for a higher level.
Where to start: a simple plan for this month
You can make a big difference in a few weeks if you do the easy, high-impact things first.
- Turn on MFA for email, banking, accounting software and cloud storage. This is the quickest win.
- Turn on automatic updates for your computers, phones, browsers and Office programs.
- Set up a proper backup. Use a daily cloud backup, and keep one copy that is not always plugged in. Test a restore.
- Fix admin accounts. Give staff normal accounts for daily work, and keep admin accounts for the few people who need them.
- Talk to your staff. Show them what a fake email looks like, and tell them it is always okay to ask "is this real?" before clicking.
Once those five are done, ask your IT support person to help with application control, Office macro settings and browser settings. If you do not have an IT person, ASD's small business guide is a good free place to learn more, or we can help (see below).
Final thoughts
You do not need to be a tech expert to protect your business. You need a few good habits, done every day. The Essential Eight gives you a clear list of what to do, and the best time to start is now, before something goes wrong.
Pick one step from the plan above and do it today. Then do the next one next week. Small steps add up, and they can save you thousands of dollars and many sleepless nights.
How GoUpp can help with your Essential Eight
If this feels like a lot to take on alongside running your business, you do not have to do it alone. GoUpp is an Australian IT team, and we help small businesses put the Essential Eight in place in plain, practical steps.
- Check where you stand. We look at your computers, accounts and backups, and show you your maturity level for each of the eight steps, in plain words.
- Give you a simple plan. You get a short list of what to fix first, starting with the quick wins like MFA, updates and backups.
- Set it up for you. We turn on MFA, automatic updates, safe backups, separate admin accounts, macro settings and application control, without getting in the way of your day-to-day work.
- Train your team. A short, friendly session so your staff can spot a fake email before they click.
- Keep it working. Through our managed IT support, we keep updates running and test your backups, so you stay protected month after month.
Remember Sarah? With MFA on her email, macros blocked and a cloud backup the laptop could not touch, that Monday would have been just another Monday. That is what we want for your business too.
- Essential Eight
- Cyber security
- Small business