Sooner or later, someone, an insurer, a funder, your IT provider, mentions the "Essential Eight," and it sounds like a mountain to climb. It isn't. It's eight sensible habits recommended by the Australian Cyber Security Centre, and together they stop the large majority of everyday attacks. Here they are in plain language, for a small team.

  1. Control which apps can run. Only let trusted, approved programs run on your devices, so a dodgy download can't just launch itself.
  2. Keep your apps updated. Browsers, Office, PDF readers: updates quietly close the holes attackers rely on. Turn on automatic updates and you've largely got this one.
  3. Rein in Office macros. Macros are little automation scripts inside Word and Excel, handy occasionally, but a favourite way to smuggle in malware. Turn them off unless you genuinely need them.
  4. Tidy up your apps and browser. Switch off risky extras, old plug-ins, features nobody uses, that give attackers an easy way in. Less clutter, less to attack.
  5. Limit who's an administrator. Admin accounts can change anything on a system, so keep them few, and separate from the accounts people use for everyday work. Fewer keys to the kingdom.
  6. Keep your operating systems updated. Same idea as your apps, but for Windows, macOS and any servers. And retire anything too old to receive updates: unsupported gear is a standing invitation.
  7. Turn on multi-factor authentication. A code or tap on top of your password, so a stolen password alone isn't enough to get in. Start with email and anything accessible from outside the office.
  8. Back up, and test that the backups work. Back up regularly, keep a copy separate, and actually check you can restore it. This is your safety net if the worst happens.

A note on "maturity levels." You may hear the Essential Eight comes with levels (0 to 3) describing how thoroughly you do each one. On day one, ignore that. Just start doing the eight, even partway cuts your risk dramatically, and you can tighten things up over time.

You won't tick all eight overnight, and you don't need to. Pick the quick wins first: MFA and updates are a strong start, and build from there.

Want to know where you actually stand against the Essential Eight, without the 40-page report? That's what a Cyber Health Check is for.

The framework itself comes straight from the Australian Cyber Security Centre, if you want the government's own detail.