If you run a business in Australia and you're not across the Essential Eight, you're operating with a blind spot that could cost you everything — your data, your clients' trust, and potentially your cyber insurance coverage.
The Australian Signals Directorate (ASD) developed the Essential Eight as a baseline set of cybersecurity mitigation strategies. Originally designed for government agencies, it's now the de facto standard that regulators, insurers, and enterprise procurement teams use to assess whether an organisation takes security seriously.
Here's the complete breakdown: what each strategy means, how maturity levels work, and what it means for businesses adopting AI and SaaS platforms in 2026.
What Is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC), part of the ASD. They're designed to make it significantly harder for adversaries to compromise your systems.
They're not optional nice-to-haves. For Commonwealth government entities, Essential Eight compliance is mandatory. For private sector businesses, it's increasingly expected — particularly if you:
- Handle personal information under the Privacy Act 1988
- Need cyber insurance (insurers are asking about Essential Eight maturity)
- Sell to government or enterprise clients (procurement checklists reference it)
- Operate in regulated industries (financial services, healthcare, legal)
The framework is organised around three objectives:
- Prevent cyberattacks (Strategies 1–4)
- Limit the impact of attacks (Strategies 5–6)
- Recover data and systems (Strategies 7–8)
The Eight Strategies Explained
1. Application Control
What it is: Only approved and trusted applications can execute on your systems. Everything else is blocked by default.
Why it matters: Malware, ransomware, and unauthorised scripts can't run if they're not on the approved list. This is your first line of defence against malicious code execution.
In practice:
- Maintain a whitelist of approved applications
- Block execution of all other software, scripts, and installers
- Use application control on workstations and servers
For AI/SaaS businesses: If you're deploying AI agents or automation tools, ensure they run within controlled environments. Amulet, for example, operates within defined infrastructure boundaries — no arbitrary code execution outside the approved deployment.
2. Patch Applications
What it is: Apply security patches to applications within 48 hours of release for critical vulnerabilities, or within two weeks for non-critical patches. Remove end-of-life applications that no longer receive patches.
Why it matters: Unpatched vulnerabilities are the number one entry point for attackers. If a known exploit exists and you haven't patched, you're effectively leaving the front door unlocked.
In practice:
- Automated patch management for all applications
- Prioritise internet-facing applications (browsers, email clients, PDF readers, Office suites)
- Track and remove applications that vendors no longer support
For AI/SaaS businesses: SaaS platforms handle patching centrally — one of their core advantages. When evaluating AI tools, ask: "How quickly do you patch critical vulnerabilities?" and "Can I see your patch management policy?"
3. Configure Microsoft Office Macro Settings
What it is: Block macros from the internet, only allow vetted macros in trusted locations, and configure Office to block macros in files from untrusted sources.
Why it matters: Macros have been one of the most common malware delivery mechanisms for decades. A malicious macro in an email attachment can compromise an entire network.
In practice:
- Disable all macros by default for users who don't need them
- Only allow signed macros from trusted publishers
- Block macros in files downloaded from the internet
For AI/SaaS businesses: If your AI tools process documents (contracts, reports, spreadsheets), ensure they handle macro-enabled files safely. Amulet processes documents in sandboxed environments — macros are stripped and never executed.
4. User Application Hardening
What it is: Configure web browsers and other applications to block ads, Java, Flash, and other unnecessary features that attackers exploit.
Why it matters: Every unnecessary feature is an attack surface. Browser-based attacks exploit JavaScript, Java applets, Flash, and malicious advertisements.
In practice:
- Block Flash (already end-of-life)
- Block Java from the internet
- Disable unnecessary browser features and extensions
- Block web advertisements (a common malware vector)
For AI/SaaS businesses: Web-based AI tools should implement Content Security Policies (CSP), disable unnecessary browser APIs, and minimise the client-side attack surface. Review the security headers of any SaaS platform you adopt.
5. Restrict Administrative Privileges
What it is: Only grant administrative access to users who genuinely need it, and only for the specific tasks that require it. No persistent admin access for day-to-day work.
Why it matters: If an attacker compromises a standard user account, the damage is limited. If they compromise an admin account, they own everything. Restricting privileges contains the blast radius.
In practice:
- Separate admin accounts from regular user accounts
- Use just-in-time (JIT) access for administrative tasks
- Regularly review and audit admin access
- No shared admin credentials
For AI/SaaS businesses: This is critical for AI platforms. AI agents that take actions (sending emails, modifying documents, accessing data) must operate under the principle of least privilege. Amulet implements granular permission scoping — each agent only has access to the specific resources it needs, with full audit logging of every action.
6. Patch Operating Systems
What it is: Apply OS patches within 48 hours for critical vulnerabilities, within two weeks for non-critical. Replace end-of-life operating systems.
Why it matters: The operating system is the foundation. If it's compromised, nothing built on top of it is safe.
In practice:
- Automated OS patch management
- Prioritise internet-facing systems
- Replace Windows 10 (end of support October 2025), older macOS versions, and unsupported Linux distributions
- Test patches in staging before production deployment
For AI/SaaS businesses: For cloud-hosted AI platforms, ask about the underlying infrastructure. What OS versions are running? How quickly are patches applied? Amulet runs on current, patched infrastructure in the Sydney AWS region with automated patch management.
7. Multi-Factor Authentication (MFA)
What it is: Require MFA for all users accessing sensitive systems — VPNs, remote access, privileged accounts, and cloud services. Phishing-resistant MFA (hardware tokens, passkeys) is the gold standard.
Why it matters: Passwords alone are not enough. Credential theft, phishing, and brute-force attacks bypass single-factor authentication trivially. MFA adds a second barrier that stops the vast majority of account compromise attempts.
In practice:
- MFA on all remote access and cloud services
- Phishing-resistant MFA (FIDO2/WebAuthn) for privileged accounts
- MFA for all users, not just admins
- Disable SMS-based MFA where possible (SIM swapping risk)
For AI/SaaS businesses: Any AI platform handling your business data must enforce MFA. No exceptions. Amulet requires MFA for all accounts and supports passkey-based authentication for maximum security.
8. Regular Backups
What it is: Perform regular backups of important data, software, and configuration settings. Store backups disconnected from the network. Test restoration regularly.
Why it matters: If ransomware encrypts your data and you have tested, offline backups, you can recover without paying. If you don't, you're at the attacker's mercy.
In practice:
- Daily backups at minimum
- Store backups offline or in isolated cloud storage
- Test restoration quarterly (a backup you can't restore is worthless)
- Back up configurations, not just data
- Retain backups for a defined period (regulatory requirements vary)
For AI/SaaS businesses: Your AI platform should maintain its own backup regime, but you're also responsible for your data. Ask: "Where are backups stored? How long are they retained? Can I export my data at any time?" Amulet maintains encrypted daily backups in the Sydney region with point-in-time recovery capability.
Maturity Levels: 0 to 3
The Essential Eight uses a maturity model with four levels. Each level builds on the previous one.
Maturity Level 0 — Not Aligned
The organisation has significant weaknesses in the mitigation strategy. This isn't a "starting point" — it's a gap that adversaries can and will exploit.
What it looks like: No formal application control, irregular patching, no MFA, backups not tested, admin privileges widely distributed.
Maturity Level 1 — Partly Aligned
Basic implementation of the strategy, focused on commodity threats (opportunistic attackers using publicly available tools and techniques).
What it looks like: Some application control on workstations, patching within a month for most applications, MFA on internet-facing services, regular backups but not always tested.
Who should target this: Small businesses, organisations beginning their cybersecurity journey, companies not handling highly sensitive data.
Maturity Level 2 — Mostly Aligned
More comprehensive implementation, designed to resist more capable adversaries who are willing to invest time and effort.
What it looks like: Application control on workstations and servers, patching within 48 hours for critical vulnerabilities, phishing-resistant MFA for privileged users, tested offline backups.
Who should target this: Mid-market businesses, organisations handling personal information under the Privacy Act, companies in regulated industries, anyone selling to government.
Maturity Level 3 — Fully Aligned
Comprehensive implementation designed to resist the most sophisticated adversaries, including state-sponsored actors.
What it looks like: Complete application control with logging, automated patching within 48 hours across all systems, phishing-resistant MFA for all users, immutable offline backups with regular tested restoration.
Who should target this: Government agencies (mandatory), critical infrastructure, financial services, healthcare, defence industry, and any organisation handling highly sensitive data.
Why SMBs Can't Ignore the Essential Eight
If you're running a small or medium business and thinking "this is only for big companies and government," here's why you're wrong:
1. The Privacy Act Applies to You
If your business has annual turnover above $3 million, you're covered by the Privacy Act 1988 and the Australian Privacy Principles. If you handle health information, you're covered regardless of turnover. The OAIC (Office of the Australian Information Commissioner) expects you to take "reasonable steps" to protect personal information — and the Essential Eight is increasingly cited as the benchmark for what "reasonable" looks like.
2. Cyber Insurance Is Getting Stricter
Australian cyber insurers are tightening underwriting criteria. Many now ask specific questions about Essential Eight implementation during the application process. If you can't demonstrate at least Maturity Level 1, you may face higher premiums, coverage exclusions, or outright denial.
3. Enterprise Clients Require It
If you sell to larger organisations or government, their procurement and vendor risk teams will assess your security posture. The Essential Eight is the standard framework they'll reference. Without alignment, you won't pass vendor assessments.
4. The Notifiable Data Breaches Scheme
Under the NDB scheme, if you experience a data breach likely to cause serious harm, you must notify the OAIC and affected individuals. The reputational damage alone can be devastating for an SMB. Implementing the Essential Eight significantly reduces the likelihood of a breach occurring in the first place.
5. Ransomware Doesn't Discriminate
SMBs are actually more attractive ransomware targets than large enterprises — they often have weaker defences and are more likely to pay. The Essential Eight's combination of application control, patching, privilege restriction, and backups directly addresses the ransomware attack chain.
How the Essential Eight Applies to AI and SaaS
As Australian businesses adopt AI tools and SaaS platforms in 2026, the Essential Eight framework applies in two directions:
For businesses evaluating AI tools:
- Application Control: Is the AI tool approved and controlled within your environment? Can it execute arbitrary code?
- Patching: Does the vendor patch promptly? What's their vulnerability disclosure and response process?
- Macro Settings: If the AI processes documents, how does it handle macro-enabled files?
- Application Hardening: What's the attack surface of the tool? What browser features does it require?
- Admin Privileges: What permissions does the AI need? Can they be scoped to minimum necessary access?
- OS Patching: What infrastructure does the tool run on? Is it current and patched?
- MFA: Does the platform enforce MFA? What methods does it support?
- Backups: Where is your data stored? Can you export and back it up independently?
For AI/SaaS vendors operating in Australia:
The same eight strategies apply to your own infrastructure and operations. Additionally, you need to demonstrate alignment to your customers — especially enterprise and government clients.
How Amulet Aligns with the Essential Eight
Amulet was built from the ground up with Australian compliance as a core design principle, not an afterthought. Here's how we align:
| Strategy | Amulet's Approach |
|---|---|
| Application Control | Agents operate within defined infrastructure boundaries. No arbitrary code execution. Every action is scoped and audited. |
| Patch Applications | Continuous deployment pipeline with automated security patching. Critical patches deployed within hours, not days. |
| Office Macro Settings | Documents processed in sandboxed environments. Macros are stripped and never executed. |
| Application Hardening | Minimal client-side attack surface. Content Security Policy enforced. No unnecessary browser features required. |
| Admin Privileges | Granular permission model. Each agent operates with minimum necessary access. Full audit logging of every action and permission grant. |
| Patch OS | Infrastructure runs on current, patched operating systems in AWS Sydney (ap-southeast-2). Automated patch management. |
| MFA | MFA required for all accounts. Passkey/FIDO2 support for phishing-resistant authentication. |
| Backups | Encrypted daily backups in the Sydney region. Point-in-time recovery. Customer data export available at any time. |
Australian Data Residency
All Amulet data stays in Australia — specifically in the Sydney AWS region (ap-southeast-2). No data is processed offshore. No data is sent to overseas AI model providers without explicit customer consent and configuration. This aligns with both the Privacy Act's cross-border data transfer restrictions and the growing expectation from Australian regulators for local data residency.
Getting Started: A Practical Roadmap
If you're starting from scratch, here's a pragmatic order of implementation:
Phase 1: Quick Wins (Weeks 1–4)
- Enable MFA everywhere — Start here. It's the single highest-impact change.
- Set up regular, tested backups — Ensure you can recover from ransomware.
- Patch critical applications — Focus on browsers, email clients, and internet-facing tools.
Phase 2: Foundation (Months 2–3)
- Restrict admin privileges — Separate admin and user accounts.
- Patch operating systems — Ensure all systems are current and supported.
- Configure Office macro settings — Block untrusted macros by default.
Phase 3: Hardening (Months 3–6)
- Implement application control — Start with workstations, then servers.
- Harden user applications — Lock down browsers, block unnecessary features.
Phase 4: Maturity (Ongoing)
- Move from Maturity Level 1 toward Level 2
- Implement phishing-resistant MFA
- Automate patching workflows
- Regular penetration testing and gap assessments
- Quarterly backup restoration tests
Key Resources
The Bottom Line
The Essential Eight isn't optional for Australian businesses in 2026. Whether you're mandated by regulation, required by insurers, expected by enterprise clients, or simply trying to protect your business from the accelerating threat landscape — implementing these eight strategies is the minimum viable security posture.
The good news: you don't have to do everything at once. Start with MFA and backups, build toward application control and patching automation, and progressively mature your posture over time.
And when you're evaluating AI tools to adopt — including Amulet — hold them to the same standard. Ask about each of the eight strategies. Demand Australian data residency. Verify their compliance claims.
Your data deserves it. Your clients expect it. And increasingly, Australian regulators require it.
Want to understand how Amulet aligns with your specific compliance requirements? Book a free Discovery Workshop — we'll assess your current posture and provide a custom AI roadmap, whether you engage us or not.