The Essential Eight is an Australian cyber security framework designed to reduce common security risks. Small businesses do not always need the same level of complexity as a large enterprise, but the principles are still useful because they focus on practical controls that reduce the chance and impact of common attacks.
Application control
Application control limits which programs can run on business computers. For a small business, the practical starting point is to remove unnecessary software, restrict local administrator rights and prevent staff from installing unapproved applications without a reason.
Patch applications
Browsers, PDF readers, Microsoft Office and other business applications should be kept up to date. Security updates often fix vulnerabilities already known to attackers.
Configure Microsoft Office macros
Macros can be useful in some businesses but can also be abused. If your staff do not need macros, they should be restricted. If they are required, use controlled settings rather than allowing them from any document.
User application hardening
Browsers and applications should be configured to reduce risky behaviour. This can include blocking unnecessary browser extensions, restricting legacy features and keeping security settings consistent across devices.
Restrict administrative privileges
Staff should not routinely work with administrator rights unless their role requires it. Administrator access should be limited and reviewed because it can greatly increase the damage caused by a compromised account.
Patch operating systems
Windows and other operating systems should receive security updates promptly. Unsupported operating systems should be replaced because they no longer receive normal security fixes.
Use multi-factor authentication
MFA is one of the most valuable controls for Microsoft 365 and other cloud systems. It provides an additional barrier when a password is stolen or reused.
Maintain regular backups
Backups should cover the systems and data the business actually depends on, and they should be tested. Recovery access should be protected so an attacker cannot easily destroy both production data and backups.
Start with the biggest risks
A small business does not need to implement everything in one day. Start with MFA, patching, backups, administrator access and device security, then improve from there. The aim is measurable risk reduction, not simply collecting compliance checkboxes.
Shortcut Computers can help review these controls through our Cyber Security for Small Business, Microsoft 365 and backup services.
Related guides
- Microsoft 365 Security Checklist
- Business Backup Testing
- Employee IT Setup and Offboarding Checklist
