Essential Eight for NZ Business: A Plain-English Guide

The Essential Eight is a cybersecurity framework developed by the Australian Cyber Security Centre. It identifies eight key strategies that organisations should implement to protect against the majority of cyber threats. While originally designed for Australian government agencies, the framework has become a benchmark for businesses across Australasia.

The framework works because it focuses on what matters most. Rather than trying to address every possible threat, it targets the techniques attackers actually use. Studies show that implementing these eight strategies can prevent over 85% of targeted cyber intrusions.

The framework

§01

Eight strategies that matter

Each addresses an attack vector

01 Application control Only approved applications can run on your systems. This prevents malware from executing, even if it reaches your devices. Attackers cannot run their tools if your systems only allow authorised software. ›

02 Patch applications Keep applications updated with security patches. Vulnerabilities in common software like browsers, PDF readers, and Microsoft Office are frequent attack vectors. Patching within 48 hours of critical updates eliminates these entry points. ›

03 Configure Microsoft Office macros Disable macros from the internet, only allow vetted macros in trusted locations. Malicious macros remain one of the most common ways attackers deliver malware through seemingly innocent documents. ›

04 User application hardening Configure web browsers to block Flash, ads, and Java from the internet. Disable unneeded features in PDF readers and Office. Reducing the attack surface makes exploitation harder. ›

05 Restrict administrative privileges Limit who has admin access and what they can do with it. Attackers target privileged accounts because they provide the most access. Minimising admin accounts limits the damage from any breach. ›

06 Patch operating systems Keep Windows, macOS, and server operating systems current. Operating system vulnerabilities can give attackers complete control of devices. Regular patching closes these doors. ›

07 Multi-factor authentication Require more than just passwords for sensitive access. Stolen credentials are useless without the second factor. Essential for email, VPN, cloud services, and any internet-facing applications. ›

08 Regular backups Maintain offline, tested backups of critical data and systems. When prevention fails, backups enable recovery. They are your last line of defence against ransomware and destructive attacks. ›

Maturity model

§02

Three levels of implementation

Stronger protection at each tier

①

Level one

Basic implementation

Protects against commodity malware and opportunistic attackers using widely available tools. This is where most organisations should start, and for many smaller businesses it offers sufficient protection against the threats they are most likely to face.

②

Level two

Enhanced controls

Your organisation can defend against attackers who invest time and effort specifically targeting you. They may modify their tools or adapt their techniques. Organisations handling sensitive data or facing industry-specific threats typically need this level.

③

Level three

Comprehensive protection

Designed to resist sophisticated attackers with substantial resources and expertise: state-sponsored groups, advanced criminal organisations, and persistent adversaries. Government agencies and critical infrastructure organisations often require this level.

Most businesses should aim for at least Maturity Level One across all eight strategies. This provides solid protection against the majority of threats. The right level for your organisation depends on your risk profile, the data you hold, and who might want to compromise it.

How we help

§03

Essential Eight implementation

Assess, then improve

Assessment and planning

We evaluate your current security posture against each of the eight strategies. This is not a checkbox exercise. We look at how controls are actually implemented, where gaps exist, and what risks they create.

You receive a clear picture of where you stand. More importantly, you get a prioritised roadmap. Not all gaps are equally urgent. We help you focus on what matters most for your situation, considering risk, budget, and operational impact.

Current state assessment
Gap analysis by strategy
Risk-prioritised roadmap
Budget considerations

Implementation and ongoing support

We configure the controls, deploy the tools, and make the changes needed to achieve your target maturity level. This is hands-on work, not just recommendations. Our team has implemented these controls across dozens of organisations.

Security requires continuous attention. We maintain your controls, apply patches, review configurations, and ensure your protection stays current as threats evolve. The Essential Eight is not a one-time project. It is an ongoing commitment that we manage on your behalf.

The framework provides structure. We provide the expertise to make it real.

Already working with us? If you are a managed services client, we continuously work toward Essential Eight alignment as part of your service. Your security improves progressively without separate project costs.

The Essential Eight explained

Eight strategies that matter

Three levels of implementation

Essential Eight implementation

Assessment and planning

Implementation and ongoing support

Assess your Essential
Eight maturity.

New Zealand owned and operated.

The Essential Eight explained

Eight strategies that matter

Three levels of implementation

Essential Eight implementation

Assessment and planning

Implementation and ongoing support

Assess your EssentialEight maturity.

New Zealand owned and operated.

Assess your Essential
Eight maturity.