Essential Eight maturity level 1 checklist
If you do business in Australia, sooner or later an insurer or a customer asks: "do you meet the Essential Eight?" Here is the plain answer: the eight controls in plain English, what maturity level 1 really asks for, and where a small business should start.
What the Essential Eight is
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. They are not a law for most private businesses, but they have become the common yardstick: cyber insurers ask about them, government departments expect suppliers to meet them, and larger customers send questionnaires built around them.
Each strategy has three maturity levels. Maturity level 1 is aimed at stopping opportunistic attackers who use widely available tools, which is exactly the kind of attack most small businesses face. It is the sensible first target. The official wording lives in the Essential Eight maturity model; always check the current version, because ASD updates it.
The eight controls, in plain English
- Application control: only approved programs can run on staff computers, so a file someone downloads can't simply start itself.
- Patch applications: keep browsers, Office, PDF readers and anything facing the internet up to date.
- Configure Microsoft Office macro settings: block macros for people who don't need them, and block macros from files that came from the internet.
- User application hardening: browsers don't run old risky content such as Java from the web, and ads are filtered.
- Restrict administrative privileges: admin rights only for people who need them, used from separate admin accounts.
- Patch operating systems: Windows, macOS and servers updated on a schedule; unsupported versions replaced.
- Multi-factor authentication: a second step at login for email, cloud apps and remote access.
- Regular backups: backups of data, applications and settings, kept safe from ordinary accounts, and restores actually tested.
What maturity level 1 asks for
At maturity level 1 the controls are about doing the basics consistently. In practice that means:
- Multi-factor authentication on online services that hold your business data, starting with email and Microsoft 365 or Google Workspace.
- Patch applications and operating systems on a schedule, with the fastest turnaround for internet-facing services when a working exploit is known. ASD sets the exact time frames in the model.
- Application control on staff computers, at least stopping programs from running out of user folders and temporary folders.
- Office macros blocked for staff who don't need them, and blocked from internet files for everyone.
- Admin rights limited, and admin accounts not used for email or browsing.
- Regular backups performed and kept according to how critical the data is, protected so ordinary accounts cannot change or delete them, and restores tested as part of disaster recovery exercises.
Where to start: multi-factor authentication first
You don't need to do all eight on day one. This order gives the most protection for the least disruption:
- Multi-factor authentication on email. Most business compromises start with a stolen mailbox password. Turn it on for everyone, admins first.
- Regular backups you have restored. If ransomware gets through, this is what saves the business. See our guide to backup restore testing.
- Patching on autopilot. Automatic updates for browsers and Office, a monthly window for servers, and a list of anything you can't patch.
- Separate admin accounts. The account that reads email should never be able to install software on the server.
- Macros and application control. These take more testing, so do them once the first four are steady.
How to prove it to an insurer or customer
Being compliant and being able to show it are different jobs. Keep a short evidence pack, updated every quarter:
| Control | Evidence that convinces |
|---|---|
| Multi-factor authentication | Screenshot of the sign-in policy and a user list showing MFA enabled for every account |
| Patch applications & OS | An export from the update tool showing versions and dates |
| Regular backups | Backup schedule, retention settings and the last restore test report with its date and time taken |
| Admin privileges | A list of admin accounts and who owns each one |
| Application control & macros | The policy settings and one test showing a blocked file |
A one-page summary on top, with what is in place, what is still in progress and the date of the next review, answers most questionnaires in minutes instead of days.
My honest take
The Essential Eight is not glamorous, and that is its strength. Most break-ins I hear about didn't need a clever attacker; they needed one reused password without multi-factor authentication, or one unpatched server. Do the first two items on the list above this month, and you are already ahead of most small businesses. If you want a second pair of eyes, this is part of my security and compliance work.