The Essential Eight, Explained for NZ Small Business

The Essential Eight is a set of eight security measures originally developed in Australia and now widely referenced across New Zealand too. It is not a product you buy; it is a checklist of sensible things to do that, taken together, make it far harder for an attacker to cause damage. Here is what each one means in everyday language.

Stopping bad software from running

The first three strategies are about controlling what can run and what can reach your staff.

Application control

This means only approved programmes are allowed to run on your computers. If a staff member accidentally downloads something dodgy, it simply will not open. Think of it as a guest list for software.

Patching applications

Everyday apps like your web browser, PDF reader and email software regularly get security fixes. Patching means applying those fixes promptly, because attackers actively target the known holes that patches close.

Configuring Microsoft Office macros

Macros are small automated scripts inside documents. They are useful, but they are also a common way to sneak in malicious code. This strategy is about switching off macros where they are not needed and only allowing trusted ones.

Reducing the damage an attacker can do

The next strategies limit how far someone can get if they do slip through.

User application hardening

This means turning off risky features that most businesses never use, such as certain web browser add-ons and old technologies that attackers love. Fewer unnecessary features means fewer ways in.

Restricting administrator privileges

An administrator account can install software and change important settings. If everyone has that level of access, one mistake can affect everything. This strategy keeps admin rights limited to the few people who genuinely need them, and only when they need them.

Keeping the front door locked

Patching operating systems

Just like your apps, Windows and other operating systems need regular security updates. Running an outdated or unsupported system is like leaving a window open, and it is one of the most common ways businesses get caught out.

Multi-factor authentication

Multi-factor authentication, or MFA, means a password alone is not enough to log in. You also confirm it is really you, usually with a code or a tap on your phone. It is one of the single most effective things a small business can do, because it blocks most attacks that rely on stolen passwords.

Being able to recover

Regular backups

The eighth strategy is having reliable, regular backups and, crucially, knowing they actually work. If ransomware or a hardware failure wipes out your data, a good backup is the difference between a bad afternoon and a business-ending event. A backup you have never tested is really just a hope.

Maturity levels, without the jargon

The Essential Eight comes with the idea of maturity levels, which is just a way of describing how thoroughly you have put each measure in place. You do not have to reach the top level to benefit. Getting the basics working across all eight is far better than doing one perfectly and ignoring the rest.

The takeaway

None of the Essential Eight is exotic or expensive on its own. The strength comes from doing all eight together, so that if one layer is bypassed, others are still standing. For a small New Zealand business, it is a sensible framework to measure yourself against rather than a box to tick once and forget. If you are not sure where you currently stand, our team can help you assess it in plain terms. Give Comsys IT a call on 0800 724 526.