A practical security baseline for New Zealand small businesses

Where the Essential Eight comes from

The Essential Eight is a set of mitigation strategies published by the Australian Signals Directorate. It was designed to give organisations a prioritised baseline that blocks the most common intrusion techniques. It is widely referenced across the Tasman, including by insurers and some government suppliers, and many New Zealand IT providers use it as a checklist because it is clear and practical. New Zealand's National Cyber Security Centre publishes its own guidance, including a short list of critical controls, which covers similar ground. You do not need to adopt any framework formally. What matters is the underlying controls, which are almost identical whichever list you start from.

Stopping malicious code from running

Three of the eight controls aim to stop attackers running code on your computers. Application control allows only approved programs to run, so a malicious download simply does nothing. Restricting Microsoft Office macros blocks a classic attack method where a document asks you to enable content. User application hardening switches off risky features in browsers and PDF readers, such as old plugins and some types of active content.

Full application control can be demanding to set up, but small offices can start with sensible steps: block macros from internet-sourced documents, remove software nobody needs, prevent programs running from the Downloads folder, and use Microsoft Defender's attack surface reduction rules. Those measures close many of the same doors with less effort.

Patching applications and operating systems

Two of the controls are about patching, split into applications and operating systems. The aim is the same: close known vulnerabilities quickly, especially on internet-facing systems, and stop using software that no longer receives fixes. Higher maturity levels set tight deadlines for critical patches, measured in days. For a small office, the practical version is automated monthly updates for Windows, Mac and common applications, faster action on critical fixes, and a firm plan to replace anything out of support. Firewalls and remote access devices should be at the front of the queue.

Limiting the damage when something gets in

Restricting administrative privileges and multi-factor authentication are the two controls that limit how far an attacker can go. Without admin rights, malware struggles to disable defences or spread. With MFA, a stolen password alone is not enough to sign in to email, remote access or cloud services. For a small business, this means standard user accounts for everyone, separate admin accounts used only when needed, unique local admin passwords, and MFA on Microsoft 365, VPNs, remote tools and any other online service that holds business data. Prefer phishing-resistant methods, such as authenticator app number matching or passkeys, where they are available. Remove old exceptions, such as a legacy mailbox that cannot do MFA, rather than leaving them as quiet gaps.

Recovering when all else fails

The eighth control is regular backups: important data, software and settings backed up, stored separately and tested. The key words are separate and tested. Backups that sit on the same network with the same passwords can be encrypted along with everything else, and a backup that has never been restored is an assumption. Keep at least one copy that is offline or immutable, protect it with credentials different from your everyday admin accounts, and run a restore test regularly. Record how long a restore took, because that number tells you whether the business could survive the wait.

Maturity levels without the jargon

The Essential Eight describes maturity levels from zero to three. Level one is a reasonable target for most small businesses: the controls are in place and working against opportunistic attacks. Higher levels add tighter deadlines, broader coverage and stronger methods, and are aimed at organisations facing more determined attackers or holding very sensitive information. Do not get stuck on the scoring. A business that has MFA everywhere, patched systems, no everyday admin rights, macros controlled and tested immutable backups is in a far stronger position than most, whatever level it would officially score.

A sensible order for small offices

If starting from scratch, a common order is: MFA on everything first, because it is quick and stops many attacks; then backups that are separate and tested; then patching and removing unsupported software; then removing everyday admin rights; then macro and browser hardening; and finally application control. Each step makes the next one more effective. Write down where you are on each control today, what the next step is and when it is due. Reviewing that list each quarter turns a framework into steady, visible progress.