Preparing your cyber posture for 2026 does not need to be complex. If you run a small or mid-sized business, the ACSC Essential Eight gives you a clear, practical baseline that reduces breach risk, supports insurance requirements, and helps you tick compliance boxes with confidence. This guide explains each control in plain English, what maturity levels mean, and how a 90‑day rollout can work in a typical SME environment. It also shows how Screwloose IT implements multi‑factor authentication with Duo, endpoint protection with ESET, daily backups, structured patching, application control, and staff training, so you can move from intention to action.
What the Essential Eight is trying to achieve
The Essential Eight is a set of priority mitigation strategies from the Australian Cyber Security Centre. The goal is not perfection. The goal is to make it significantly harder for attackers to break in, move around, and cause damage. When you implement these controls well, you lower the chance of a breach and shorten recovery time if something goes wrong. Insurers increasingly look for these controls, and many industry frameworks map neatly to them.
Plain‑English summary of the Essential Eight
- Application control
Allow only approved software to run. This blocks malicious executables, scripts, and unauthorised tools that attackers rely on.
- Patch applications
Keep browsers, office apps, Java, PDF readers, and line‑of‑business software up to date. Critical vulnerabilities in apps are a common entry point.
- Configure Microsoft Office macro settings
Disable macros from the internet and use signing for trusted macros. Many phishing attacks still use weaponised macros.
- User application hardening
Harden browsers and apps by disabling risky features such as Flash and ads, blocking web plugins, and limiting script execution.
- Restrict administrative privileges
Give admin rights only to those who need them, use separate admin accounts, and monitor privileged activity.
- Patch operating systems
Apply OS updates within a set timeframe, prioritising critical fixes. Unsupported operating systems should be upgraded or isolated.
- Multi‑factor authentication
Add a second factor to logins for Microsoft 365, VPN, remote access, admin accounts, and critical apps. This stops most password theft attacks.
- Regular backups
Back up systems and data daily, store copies offline or immutable, test restores often, and protect backup consoles with MFA.
Maturity levels explained
Maturity levels are a simple way to plan and prove progress.
- Level One: You have controls in place for common threats, but there may be gaps.
- Level Two: Controls are consistent and enforced across your environment, reducing bypasses.
- Level Three: Controls are robust, monitored, and resistant to more sophisticated attackers.
For many SMEs, Level Two is the sweet spot in 2026. It satisfies most insurer questionnaires and materially reduces risk without heavy complexity. Some regulated sectors may aim for Level Three for certain controls such as MFA and backups.
Business impact of getting the basics right
- Reduced breach risk and downtime, which protects revenue and reputation.
- Lower cyber insurance premiums or improved insurability, since questionnaires now track MFA, patching cadence, and backups.
- Smoother audits, with evidence that maps to Essential Eight controls.
- Better staff experience, because stable and secure systems crash less and recover faster.
How Screwloose implements the core controls
- MFA with Duo: Duo adds a simple mobile prompt or hardware token for Microsoft 365, VPN, RDP, and admin tools. Screwloose enforces MFA by policy and applies conditional access to high‑risk sign‑ins.
- Endpoint protection with ESET: ESET provides behavioural detection, ransomware shields, and exploit blocking. Policies are centrally managed and tuned to your risk profile.
- Daily backups: Onsite and cloud backups run every day, with periodic offline or immutable copies. Restores are tested to confirm recovery time and integrity.
- Patching cadence: Critical OS and application patches are deployed on a defined timeline, with maintenance windows and rollback plans for stability.
- Application control: Allow‑lists restrict execution to approved software. PowerShell and scripting are limited to administrators.
- User training: Short, plain‑English sessions show staff how to spot phishing, report suspicious emails, and handle data safely. Simulated phishing reinforces good habits.
A phased 90‑day rollout plan
Phase 1, Days 1 to 30, stabilise and assess
- Run a Cyber Security Audit to baseline maturity and identify quick wins.
- Deploy ESET to all endpoints; remove legacy antivirus.
- Enforce Duo MFA for Microsoft 365, VPN, and admin accounts.
- Disable internet‑sourced Office macros and block legacy plugins in browsers.
- Begin daily backups, protect backup consoles with MFA, and perform a test restore.
Phase 2, Days 31 to 60, close high‑impact gaps
- Implement application control on a pilot group, then expand.
- Establish patching cadence for OS and key applications with staged rings.
- Remove local admin from standard users; issue separate admin accounts to IT staff.
- Harden browsers and common apps to reduce exploit surface.
- Deliver user training and launch phishing simulations.
Phase 3, Days 61 to 90, standardise and evidence
- Extend application control across the fleet and document exceptions.
- Complete OS upgrades where versions are near end of support.
- Tune ESET policies based on telemetry and detections.
- Conduct a recovery test using backups for a core system; document results. Produce evidence for each control and map to your target maturity level.
By Day 90, most SMEs can reach Level Two for key controls, with a realistic path to Level Three for MFA and backups.
How cyber security works, in practice
At its core, cyber security reduces the likelihood and impact of incidents. You identify what matters, apply layered controls, monitor for anomalies, and practice recovery. The Essential Eight provides the layers. Tools such as Duo and ESET enforce them. Backups and rehearsed recovery close the loop.
Answers to common questions
- What are cyber security services?
They include audits, risk assessments, endpoint protection, email security, MFA, vulnerability management, backup and disaster recovery, security monitoring, incident response, and staff training. Screwloose packages these into month‑to‑month Managed Cyber Security plans so you can scale as needed.
- What are the 5 types of cyber security?
A practical breakdown for SMEs covers endpoint security, network security, application security, identity and access management, and data protection and backup.
- What are the three security services?
Confidentiality, integrity, and availability. These principles guide how data is protected, verified, and kept accessible.
- What are the 7 domains of cyber security?
User, workstation, LAN, LAN‑to‑WAN, WAN, remote access, and system or application domains. The Essential Eight touches each domain by limiting what runs, hardening endpoints, controlling access, and maintaining recoverability.
- What is the average cost of cyber security services?
Costs vary by size and risk. As a benchmark, monitoring starts from $15 + GST per user per month, with full managed services from $30 + GST per user per month. Managed IT support that includes security oversight can start from $55 per business monthly. Project work, such as an initial audit or remediation, is scoped to your environment.
When to bring in a partner
If you lack in‑house capacity, a partner can accelerate progress and provide the evidence insurers and auditors want. Screwloose operates with Australian‑based technicians, short helpdesk wait times, and no lock‑in contracts. You stay in control while gaining a team that handles daily patching, alerting, and recovery drills.
If you want to explore broader support across your environment, you can learn more about it managed services and how a managed it services provider can reduce risk while improving reliability. If your focus is security uplift only, review Screwloose’s cyber security services for audit, implementation, and ongoing management.
Summary and next steps
The Essential Eight is a practical playbook for 2026. Focus on MFA, patching, application control, and backups, with user training to tie it together. Aim for Level Two maturity across most controls, then raise specific areas to Level Three as your risk profile demands. Screwloose can run a comprehensive Cyber Security Audit, implement Duo, ESET, daily backups, and a sustainable patching cadence, then support you on month‑to‑month Managed Cyber Security plans.
Ready to benchmark your maturity and cut your risk this quarter? Book a Cyber Security Audit and move through a 90‑day rollout with a team that delivers fast, transparent results