Essential Eight check for small business

What it does

This skill takes a small business through the eight mitigation strategies published by the Australian Signals Directorate (ASD). For each one it explains what the strategy means for a business of 5 to 50 people, asks plain questions, and returns a gap list against the Maturity Level One requirements with a fix order.

It is a guided self-check and certifies nothing. Only an assessment run under ASD's Essential Eight assessment process guide can say which maturity level a business has reached, so the output must never claim a level has been achieved.

When to use it

• A customer, insurer or tender form asks about the Essential Eight.
• The business has had a scare, such as a phishing email or a lost laptop.
• The owner is reviewing what their IT provider does, or is changing providers.

What you need

• Staff numbers, and the devices in use (Windows, Mac, Chromebook, phones).
• Whether the business runs on Microsoft 365 or Google Workspace, and the plan if known.
• Whether there is an office server or network storage device.
• Who looks after IT: the owner, a staff member or a managed service provider.
• Optional: exports or screenshots from the Microsoft 365 admin centre or the Google Admin console. No connector is required.

Steps for Claude

1. Confirm the scope above in one short message. Note that ASD designed the Essential Eight for internet-connected IT networks, not phones or machinery.
2. Work through the eight strategies in order. For each, give a two or three sentence plain explanation, then ask the questions below. Treat "I don't know" as a valid answer and record it as "Unknown, confirm with IT".
   • Patch applications. Are automatic updates on for browsers, Office or Workspace apps, PDF readers and security software? Is anyone using software the vendor no longer supports? Does anyone check for missing updates on a schedule?
   • Patch operating systems. Are Windows, macOS and ChromeOS updating automatically? Is any computer running an operating system that no longer gets updates?
   • Multi-factor authentication (MFA). Is MFA enforced for every staff email account, not just available? Is it on for admin accounts, banking, accounting software, the website login and any customer portal?
   • Restrict administrative privileges. Does anyone use an admin account for everyday email and web browsing? Do staff have admin rights on their own laptops? Who can approve a new admin account?
   • Application control. Can staff install any program they like? Is there a list of approved software, and is anything enforcing it?
   • Restrict Microsoft Office macros. Are macros turned off for staff who do not need them, and blocked in files from the internet? Can staff change those settings?
   • User application hardening. Is Internet Explorer 11 disabled or removed? Do browsers block web ads and Java from the internet? Can staff change browser security settings?
   • Regular backups. What is backed up, how often, and where is it kept? Can an ordinary staff account delete or change the backups? When was a restore last tested? Do not assume that files syncing to OneDrive or Google Drive count as a backup; ask whether a separate backup exists.
3. For each strategy, compare the answers with the Maturity Level One requirements in the official maturity model and mark it Met, Partly met, Not met or Unknown. Quote the business's own answer as the evidence.
4. Build the fix order. Start with the three measures the ACSC small business guide recommends as a starting point: turn on MFA, update software, and back up information. Then separate admin accounts, then macro and browser settings set centrally from the admin console, then application control, which usually needs device management tools and help from an IT provider.
5. Remind the user that ASD advises reaching the same maturity level across all eight strategies before aiming higher.

Output format

1. A one-paragraph summary in plain English.
2. A table: Strategy, Status, Evidence from answers, What Maturity Level One expects (paraphrased), Next action, Who does it.
3. A numbered fix list of no more than ten items, each with an owner and a target week.
4. A list of "Unknown" items to put to the IT provider, worded as questions.

Australian rules and sources

• Essential Eight overview (ASD): https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
• Essential Eight maturity model, November 2023 version, the source for all Maturity Level One requirements: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
• Essential Eight assessment process guide: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-assessment-process-guide
• Small business cyber security guide: https://www.cyber.gov.au/business-government/small-business-cyber-security/small-business-hub/small-business-cyber-security-guide
• Small business cloud security guides, with technical examples for Microsoft 365: https://www.cyber.gov.au/business-government/small-business-cyber-security/small-business-hub/small-business-cloud-security-guides
• Small business hub, including "how to" guides for Apple, Google and Microsoft: https://www.cyber.gov.au/business-government/small-business-cyber-security/small-business-hub

Check the maturity model page for a newer version before each use. Do not quote patching deadlines from memory; point the user to the model.

Limits

This is general information, not a security assessment or legal advice. Changing admin, macro or application control settings can lock people out of systems, so the business should test changes with its IT provider first. If an incident is happening now, stop this check and follow ASD's reporting guidance at https://www.cyber.gov.au/report-and-recover/report.

Example requests

• "We're 12 people on Microsoft 365 with an outsourced IT guy. Where do we stand on the Essential Eight?"
• "Our insurer asked if we meet Essential Eight Maturity Level One. Help me work out the honest answer."
• "We use Google Workspace and Chromebooks. Which of the Essential Eight should we fix first?"