The Australian Signals Directorate's Essential Eight has been around since 2017 — but in 2026, it's no longer a 'nice to have'. Cyber insurers are asking for it. Government contracts require it. Investors and boards are starting to expect it. And yet most Australian SMBs still treat it as something that happens to bigger organisations.
It's eight specific security controls, ranked by how effectively they prevent the most common attack types. They were developed by the Australian Cyber Security Centre (ACSC) based on real incident data — not theory. Each control is rated at Maturity Level 1, 2 or 3 depending on how rigorously it's implemented.
Most SMBs need ML1 as a baseline. Government suppliers typically need ML2. ML3 is for high-value targets and critical infrastructure.
In our experience reviewing Australian SMB environments, the most commonly missed controls are patching, MFA and admin privilege restriction — not because they're difficult, but because they've been deprioritised to avoid disruption.
Most businesses say: 'We'll do patching when things are quieter.' But patching doesn't work that way. Vulnerabilities don't wait for a quiet week. The businesses that get hit are the ones that kept deferring.
The implementation approach matters as much as the controls themselves. Too many IT providers 'align to Essential Eight' on paper — meaning they tick boxes in a spreadsheet — without actually changing anything in the environment.
A proper implementation using the Microsoft stack (which most Australian SMBs already have) looks like this:
Essential Eight is not a one-time project. It's a baseline you maintain. The first implementation gets you to ML1. Staying there requires ongoing management — which is why we include compliance reporting in every managed support plan.
We identify the gaps and tell you exactly what to fix first.
