The Essential Eight, Explained in Plain English

If you've looked into cybersecurity for your business, you've probably hit the phrase "Essential Eight". It's the Australian Cyber Security Centre's baseline set of protections — and it's far less scary than it sounds. Here's the plain-English version.

The eight, translated

1. Application control — only approved programs can run on your computers. Think of it as a guest list for software.

2. Patch applications — keep programs like browsers, Office and PDF readers up to date so known holes get closed.

3. Restrict Microsoft Office macros — block the hidden scripts inside documents that criminals love to abuse.

4. Harden user applications — turn off features you don't need (like Flash and web ads in Office) so there's less to attack.

5. Restrict admin privileges — everyday accounts shouldn't be able to install anything or change system settings. Fewer keys to the kingdom.

6. Patch operating systems — keep Windows and macOS updated, just like your applications.

7. Multi-factor authentication (MFA) — a password plus a second check (usually your phone). This single step stops the majority of account-takeover attacks.

8. Regular backups — copies of your data, kept separate, tested regularly, so ransomware or hardware failure can't wipe you out.

Do small businesses really need this?

Yes — and increasingly, your clients and insurers expect it. The Essential Eight comes in "maturity levels", and most SMEs should aim for level one or two: practical, affordable protections rather than enterprise-grade complexity.

Where to start: MFA and tested backups deliver the biggest risk reduction for the least cost. UMI helps Adelaide businesses assess their current posture and close the gaps in priority order — book a free consultation to find out where you stand.