If you’ve ever tried to google “what cyber security framework should my business use,” you’ve probably landed on a wall of acronyms — NIST, ISO 27001, ISM, Essential Eight — and closed the tab more confused than when you started.
Here’s the plain answer for Brisbane small businesses: the Australian Cyber Security Centre’s Essential Eight is where you start. It’s the Australian Government’s baseline for business cyber security, it’s what your cyber insurer is starting to ask about, and it maps directly to the attacks that actually hit SMBs.
This post explains what the Essential Eight is, what it means in practice for a 10-100 person business, and why most Brisbane SMBs are starting from a lower baseline than they realise.
What Is a Cyber Security Framework?
A cyber security framework is a structured set of controls — actions you take to reduce the risk of a breach, ransomware attack, or data loss. Think of it as a checklist that’s been validated against real-world attacks.
Frameworks don’t replace your IT provider. They give you (and your IT provider) a shared language for what “good” looks like, so you’re not just hoping things are secure.
The Main Frameworks and Why Essential Eight Wins for Australian SMBs
For a 20-person Brisbane professional services firm, ISO 27001 certification is expensive overkill. NIST was designed for a different regulatory environment. The Essential Eight was written for Australian businesses, updated regularly by the ACSC, and directly referenced by the ASD, cyber insurers, and the ATO. Start with Essential Eight.
The Essential Eight: What It Actually Covers
- Application control — Only approved software can run on your systems. Stops malware and unauthorised tools.
- Patch applications — Keep business software up to date. Most ransomware exploits known vulnerabilities in outdated software.
- Configure Microsoft Office macro settings — Macros in Word and Excel documents are a common attack vector. Restrict who can run them.
- User application hardening — Block Flash, ads, and Java from running in browsers. Reduces web-based attack surface.
- Restrict administrative privileges — Limit who has admin access. Most attacks rely on elevated permissions to spread.
- Patch operating systems — Keep Windows patched. Critical patches within 48 hours, the rest within a month.
- Multi-factor authentication (MFA) — Require a second factor to log in to email, cloud services, and remote access. Stops compromised passwords becoming account takeovers.
- Regular backups — Back up data, test the restore, keep backups offline or in an immutable cloud store. Your last line of defence against ransomware.
Maturity Levels: Where Does Your Business Sit?
- Maturity Level 0 — Controls are missing or ineffective. This is where most SMBs land when they are honest about it.
- Maturity Level 1 — Basic controls are in place. Protected against opportunistic attacks (phishing, commodity ransomware).
- Maturity Level 2 — Controls are consistent and tested. Protected against more targeted attacks.
- Maturity Level 3 — Comprehensive, monitored, continuously improved. For government contractors or high data-sensitivity businesses.
For most Brisbane SMBs, Maturity Level 1 is the right starting target. It reduces real-world risk significantly and satisfies most cyber insurance requirements. Level 2 is the goal for businesses handling client financial data, health records, or legal documents.
What Most Brisbane SMBs Get Wrong
- “We have antivirus” — Antivirus alone is Maturity Level 0. It does not cover patching, MFA, admin privileges, or backups.
- “We use Microsoft 365” — M365 is a great platform, but out of the box it does not enforce MFA, does not restrict macros, and does not include tested backups. Those require configuration.
- “Our IT company handles it” — Maybe. Ask them to show you your Essential Eight maturity assessment. If they cannot, you do not actually know where you stand.
- “We are too small to be targeted” — Ransomware and phishing are automated. They target by vulnerability, not size. A 15-person accounting firm is as exposed as a 500-person enterprise without the right controls.
Cyber Insurance and the Essential Eight
Cyber insurance underwriters are paying attention. Insurers have started requiring evidence of MFA, patching practices, and backup testing as conditions of cover — not just at renewal, but as mid-policy audit requirements. If you cannot demonstrate at least Maturity Level 1 controls, you may find your claim denied after a breach, or premiums significantly higher at renewal.
How Connected Platforms Approaches the Essential Eight
Essential Eight alignment is a foundation of every CP managed IT engagement — not an add-on, not a separate project. When you come on board, we assess your current maturity, identify the gaps, and work through them as part of your onboarding.
For most 10-100 user businesses, getting from Maturity Level 0 to Level 1 across all eight controls is achievable within the first 90 days — without disrupting how your team works.
If you want to know where your business sits right now — honestly, not optimistically — that is exactly what our 20-minute discovery call covers.
No obligation. Just a straight answer on where you stand and what it would take to fix it.
