Essential Eight for Small Business: Your First 90 Days

Short answer: Start the Essential Eight by finding out where you stand, then fix the controls that stop the most common attacks: multi-factor authentication, patching, admin privileges and tested backups. Aim for Maturity Level One across all eight strategies before going further. Most small businesses can make real progress in the first 90 days using tools they already pay for.

The Essential Eight is the Australian Signals Directorate’s (ASD) baseline set of cyber security controls. If you need the background, read what the Essential Eight is. If you want to understand the levels, read our guide to Essential Eight maturity levels. This post is about the practical part: what to do first.

Why should a small business care about Essential 8 cyber security?

Small businesses are attractive targets because they often have less protection than larger organisations but still hold money, customer data and access to bigger clients’ systems. Most attacks on small businesses are not sophisticated. They rely on stolen passwords, unpatched software and staff clicking a convincing email.

The Essential Eight is designed around exactly those attacks. It is also increasingly what customers, insurers and government buyers ask about, so working towards it helps when you fill in a security questionnaire.

Where should we start with the Essential Eight?

Start with an honest picture of your current position. You cannot prioritise without knowing your gaps. A basic self-check covers:

• Which accounts have multi-factor authentication (MFA), and which don’t
• How many people have admin rights on their devices or in Microsoft 365
• How quickly updates are applied to Windows, browsers and Office
• What is backed up, where, and when a restore was last tested
• Whether staff can run any software they download

Write down the answers. That list becomes your plan.

Which Essential Eight controls should come first?

All eight matter, and ASD recommends reaching the same level across all of them. But some deliver protection faster than others, so the order you tackle them in matters.

1. Multi-factor authentication

Stolen passwords are behind a large share of business email compromise. Turning on MFA for email, Microsoft 365, remote access and any online banking or finance systems is one of the highest-value steps you can take. Prefer an authenticator app over SMS codes where you can.

2. Restrict administrative privileges

Staff should not use admin accounts for everyday work. Remove local admin rights from user devices and give admins a separate account used only for admin tasks. This limits what an attacker can do if one account is compromised.

3. Patch applications and operating systems

Turn on automatic updates and make sure someone checks they are actually applying. Pay particular attention to internet-facing systems, browsers, Microsoft Office and PDF readers. Replace any devices or software that no longer receive security updates.

4. Regular backups

Back up important data, including Microsoft 365 mailboxes, OneDrive and SharePoint, and keep backups separate from your normal accounts so ransomware can’t reach them. Then test a restore. Many businesses find out their backups don’t work only when they need them.

5. Microsoft Office macro settings and user application hardening

Block macros from the internet and restrict them to users who genuinely need them. Harden browsers and Office so they can’t easily be used to run malicious content. In a Microsoft 365 environment much of this can be set centrally.

6. Application control

Application control means only approved software can run. It is often the hardest control for small businesses because it needs a list of what your staff actually use. Plan it after the quicker wins, but don’t skip it.

What does a practical first 90 days look like?

Days 1–30: assess and secure accounts. Complete the self-check above or get an assessment. Turn on MFA everywhere it is available. Remove unnecessary admin rights and set up separate admin accounts.

Days 31–60: patching and backups. Confirm automatic updates across devices and key applications. Identify unsupported systems. Review backup coverage and run a test restore.

Days 61–90: harden and plan the rest. Apply macro and application hardening settings. Start building an approved software list for application control. Run security awareness training so staff know what phishing looks like, and review your email security settings.

At the end of 90 days you should know which controls meet Maturity Level One and have a dated plan for the rest.

Can we use Microsoft 365 for the Essential Eight?

Yes, for much of it. Microsoft 365 business plans include tools for MFA, device management, patching, macro settings and admin control. The catch is that most of these need to be configured; they are not all on by default. Our post on Microsoft 365 Business Premium and the Essential Eight explains what that licence covers.

What mistakes do small businesses make with the Essential Eight?

• Treating it as a one-off project. Patching, access reviews and backup tests need to keep happening.
• Turning MFA on for some accounts only. Attackers look for the account that was missed, often a shared mailbox or an old admin account.
• Assuming backups work. Without a test restore you don’t know.
• Chasing a higher level on one control. A strong MFA setup does little if backups are untested. Get all eight to the same level first.
• Doing it without documentation. If you can’t show what is in place, you can’t prove it to a customer or insurer.

How Loginet helps

Loginet Technologies has supported Queensland businesses for more than four years. We are a Microsoft Partner, AWS Partner and Microsoft Azure Partner, and our team of 20+ IT experts holds certifications across AWS, Microsoft, Cisco, Palo Alto, Fortinet and CEH.

Our Essential Eight services start with an assessment against the current ASD model, followed by a prioritised plan and the hands-on work to close gaps. For Gold Coast businesses, our team at our Bundall office also provides managed IT services on the Gold Coast to keep controls in place month to month.

Frequently asked questions

Take the first step

Not sure where your gaps are? Let’s talk and we will help you assess your Essential Eight position and build a practical plan to reach Maturity Level One.