If you've heard the term "ASD Essential Eight" but aren't sure what it actually means for your Perth business, you're not alone. It's government-speak for what is actually a very practical set of cybersecurity actions — and for most Perth SMBs, implementing them is more straightforward than you'd think.
This guide explains each of the eight controls in plain English, tells you what your business needs to do, and helps you understand where to start.
What Is the ASD Essential Eight?
The ASD Essential Eight is a set of eight cybersecurity strategies developed by the Australian Signals Directorate (ASD) — the Australian Government's signals intelligence and cyber security agency — to help organisations protect their systems against the most common types of cyber attacks.
It is published and maintained by the Australian Cyber Security Centre (ACSC) as part of the Strategies to Mitigate Cyber Security Incidents framework. The Essential Eight represents the top eight strategies that, when implemented together, can prevent the majority of cyber attacks targeting Australian businesses.
Why the Essential Eight Matters for Perth SMBs
Cyber attacks on Australian businesses increased by 23% in the 2024–25 financial year, according to the ACSC Annual Cyber Threat Report. Small and medium businesses were the most targeted group — and Western Australia's resources, legal and healthcare sectors were among the hardest hit.
The most common attack vectors are:
- Phishing emails targeting staff credentials
- Unpatched software vulnerabilities exploited by automated scanning tools
- Weak or stolen passwords used to access business accounts
- Ransomware deployed after an initial foothold is established
All four of these attack methods are directly prevented or significantly mitigated by the Essential Eight controls. That's why the ASD developed them — they are the minimum effective defence for any Australian business operating online.
The Eight Controls — Explained in Plain English
Application Control
Application control prevents malicious software (malware) from running on your systems — even if it somehow gets onto a device. It works by creating a whitelist of approved applications; anything not on the list simply cannot execute.
Patch Applications
Cybercriminals regularly exploit known vulnerabilities in outdated software. The ASD recommends patching internet-facing applications within 48 hours of a critical patch being released, and all other applications within two weeks.
Configure Microsoft Office Macro Settings
Microsoft Office macros (automated scripts in Word, Excel, PowerPoint) are one of the most common malware delivery methods. Attackers send phishing emails with macro-enabled documents — when opened and the macro runs, malware is installed.
User Application Hardening
Web browsers and PDF viewers are common attack surfaces. Hardening means disabling or restricting features like Flash, Java in browsers, ads from unknown sources, and unnecessary browser extensions.
Restrict Administrative Privileges
Administrator accounts have full system access. If an attacker compromises an admin account (via phishing or stolen password), they can do anything — install malware, delete backups, export all data. The principle of least privilege means staff only get access to what they need.
Patch Operating Systems
Similar to patching applications, operating system vulnerabilities are actively exploited by attackers. Critical OS patches should be applied within 48 hours of release. End-of-life operating systems (like Windows 10 after October 2025) should be upgraded — no patches means no protection.
Multi-Factor Authentication (MFA)
Multi-factor authentication (MFA) is the single most effective control for preventing account compromise. Even if a staff member's password is stolen (via phishing), MFA means an attacker still can't log in without the second factor (phone notification, authenticator app code, or hardware key).
Regular Backups
Backups are your last line of defence against ransomware. If all else fails and ransomware encrypts your data, a tested, recent, offline backup means you can recover without paying the ransom. The ASD requires backups to be stored separately from the main system — so ransomware cannot encrypt both simultaneously.
Essential Eight Maturity Levels: What Do They Mean?
The ASD Essential Eight Maturity Model has three levels. Rather than aiming for perfection immediately, the model allows businesses to incrementally improve their cybersecurity posture.
| Maturity Level | What It Means | Who Should Target This |
|---|---|---|
| Level 0 | Controls are not in place or are ineffective. Significant risk of common cyber attacks. | No business should remain at Level 0. |
| Level 1 | Basic controls in place. Protects against opportunistic, low-sophistication attacks such as automated scanning and spray-and-pray phishing. | Minimum target for all Perth SMBs. Achievable within 4–8 weeks with a managed IT provider. |
| Level 2 | Controls are more comprehensive. Protects against targeted attacks where an adversary is specifically trying to breach your business. | Recommended target for Perth SMBs in healthcare, legal and finance. Takes 3–6 months to achieve. |
| Level 3 | Controls are fully implemented and continuously monitored. Protects against sophisticated, persistent adversaries. | Government agencies and high-risk private sector businesses. Ongoing investment required. |
For most Perth SMBs, the realistic and appropriate goal is Maturity Level 2. Level 1 is the absolute minimum. If your business handles sensitive client data — medical records, financial information, legal files — you should be targeting Level 2 as quickly as practical.
Where to Start: A Practical Action Plan for Perth Businesses
The idea of implementing eight cybersecurity controls can feel overwhelming, but in practice, a managed IT services provider handles all of this on your behalf. Here's a simple priority order for a Perth SMB starting from scratch:
Get Your Perth Business Essential Eight Assessed
Managed ICT Solutions offers a free Essential Eight assessment for Perth businesses — we'll review your current cybersecurity posture against all eight controls and give you a clear picture of where you stand and what needs to be done.
Book a Free Cyber Assessment View Our Cybersecurity Services