What is VMAAS Australia Risk Portal?

A streamlined risk-based vulnerability management portal designed for Australian SMBs to align with ACSC Essential Eight and SMB1001 security standards.

Who publishes the Essential Eight, and is it official government guidance?

Yes - the Essential Eight is published by the ASD and ACSC, which are Australian government agencies. It derives from the Information Security Manual (ISM), which is the ASD's comprehensive cybersecurity framework for government systems. While originally designed for government, it's now the de-facto baseline security standard for Australian organisations of all sizes.

Is the Essential Eight mandatory for Australian businesses?

Not universally - but it's heading that way. Federal government agencies are required to implement Essential Eight at Maturity Level 2 or higher. Critical infrastructure operators have obligations under the Security of Critical Infrastructure Act. For most private-sector businesses, Essential Eight is currently a strong recommendation rather than a legal requirement, though cyber insurance providers and some enterprise procurement processes are beginning to treat it as a baseline expectation.

Is the Essential Eight relevant for small businesses?

Yes - in fact, Maturity Level 1 (ML1) is specifically designed to be achievable by organisations without dedicated security teams. The strategies at ML1 target opportunistic, automated attacks - the kind that hit small businesses most often because attackers use tools that scan indiscriminately. A business with five employees faces the same automated threats as one with five hundred.

Does the Essential Eight replace frameworks like ISO 27001 or the NIST Cybersecurity Framework?

No - they serve different purposes. ISO 27001 is a comprehensive information security management standard suitable for organisations that need formal certification (often required by enterprise customers or regulated industries). The Essential Eight is a focused, action-oriented framework covering eight high-impact technical controls. They're complementary: many organisations achieve Essential Eight ML1 or ML2 as a practical foundation, then pursue ISO 27001 if certification becomes commercially necessary.

What's the difference between Maturity Level 1 and Maturity Level 2?

ML1 focuses on consistent implementation of each strategy across your environment - patching critical vulnerabilities within 48 hours, MFA on remote access and admin accounts, application control on workstations. ML2 raises the bar significantly: patching windows tighten to two weeks for non-critical patches, MFA must cover all internet-facing services, and controls must work even when users or administrators try to circumvent them. ML2 also introduces stricter logging and monitoring requirements.

Which maturity level should my business target?

For most Australian SMBs, ML1 is the right first target. It substantially reduces your exposure to the threats that cause the most incidents - ransomware, phishing, credential theft - without requiring enterprise-level security tooling or a dedicated security team. Once ML1 is consistently implemented and verified, reassess whether your risk profile or business requirements (customer contracts, insurance, regulatory) justify investing in ML2.

How much does Essential Eight implementation cost?

At ML1 for a cloud-first SMB (Microsoft 365 or Google Workspace), most controls don't require additional software - they're configuration changes within tools you're already paying for. The main costs are time (internal effort or consultant fees) and potentially minor licensing upgrades. Microsoft 365 Business Premium includes most of the technical controls needed for ML1; Google Workspace Business Standard or Plus covers most of the Google equivalent. A realistic budget for a 20-person business engaging external help is $3,000-$8,000 for initial implementation.

Do I need to implement all eight strategies?

The ASD recommends implementing all eight, because the strategies are designed to complement each other - each one reduces risk in ways that support the others. That said, implementation is often phased in practice. If you have to prioritise, patching (both applications and OS), MFA, and application control deliver the most risk reduction per unit of effort and are the strategies most commonly referenced in post-incident reviews.

Can I implement the Essential Eight myself, or do I need a consultant?

For a straightforward Microsoft 365 or Google Workspace environment at ML1, a technically capable business owner or IT administrator can implement most controls without external help - especially with a good step-by-step guide. Where external help becomes valuable: if you have on-premises infrastructure, complex Active Directory environments, or you want formal assessment and evidence for an insurance or procurement requirement.

How do I know if I've actually achieved Essential Eight ML1?

The ASD publishes an Essential Eight Assessment Process Guide that describes how assessors verify each control. For self-assessment, you should be able to demonstrate: that critical patches were applied within 48 hours of your last patch cycle, that MFA is enforced on all remote access and admin accounts (not just configured but not bypassed), that application control is blocking unauthorised executables, and that backup restoration has been tested recently. If any of those are 'yes in principle but we haven't verified it', you're not yet at ML1.

How often do I need to review my Essential Eight implementation?

At a minimum, after every significant change to your environment (new systems, new cloud services, new staff with elevated access) and after any security incident. Practically, a quarterly review of patch status, admin account inventory, and backup restoration test covers most of what degrades over time. The ASD updates the Essential Eight framework periodically - subscribe to ACSC alerts to stay current with any changes to the control requirements.

We use both Microsoft 365 and Google Workspace. Do we need to implement the Essential Eight for both?

If users access business data through both platforms, then yes - controls need to cover both environments. In practice, most organisations with a mixed estate have a primary identity provider (usually Microsoft Entra ID or Google Workspace) that controls access to both, which simplifies MFA and conditional access. The patching and application control strategies apply at the device level regardless of which cloud platform you use.

How does the Essential Eight relate to the Notifiable Data Breaches scheme and the Privacy Act?

The Essential Eight and the Privacy Act address overlapping but different concerns. The Privacy Act (and the NDB scheme within it) sets obligations around how you handle personal information and what you must do when a breach occurs. The Essential Eight is a technical framework for reducing the likelihood of a breach in the first place. Implementing Essential Eight ML1 won't guarantee Privacy Act compliance, but it substantially reduces the risk of a breach that would trigger NDB reporting obligations - and demonstrates reasonable steps to protect data, which is relevant in any regulatory or legal assessment after an incident.

FAQ

Essential Eight - questions answered

Straight answers to the questions Australian businesses ask most about the Essential Eight - what it is, whether it applies to you, and what it actually takes to implement.

The basics

FAQ

Frequently asked questions

The Essential Eight is a set of eight prioritised cybersecurity strategies published by the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC). They're designed to protect Microsoft Windows-based environments against the most common cyber threats - things like ransomware, phishing, and credential theft. The strategies are: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups.

Maturity levels

FAQ

Frequently asked questions

There are four: ML0 through ML3. ML0 means the strategy isn't implemented at all. ML1 targets opportunistic attackers using automated, commodity tools - the most common threat facing Australian SMBs. ML2 targets more capable adversaries who adapt their approach when initial attempts fail. ML3 targets sophisticated, well-resourced attackers prepared to invest significant effort in a specific target. Most Australian businesses should aim for ML1 as a starting point and reassess from there.

Implementation

FAQ

Frequently asked questions

It depends heavily on your starting point and the platform you're on. For a Microsoft 365 or Google Workspace environment starting from scratch, reaching ML1 typically takes four to eight weeks of focused effort - longer if you have legacy systems, mixed environments, or need to get staff through MFA enrolment. The work isn't usually technically complex; the challenge is doing it consistently across every user and device, and getting stakeholder buy-in for changes like restricting admin access.

Cloud and SaaS environments

FAQ

Frequently asked questions

Yes, though the application requires some interpretation. The Essential Eight was written primarily for on-premises Windows environments, but the ASD has published guidance on applying it to cloud services. Most ML1 controls have direct equivalents in Microsoft 365 and Google Workspace: MFA maps to Entra ID or Google's identity policies; application control maps to device management policies; patching maps to keeping your Microsoft 365 or Workspace clients current. The VMAAS guides cover this mapping in detail for both platforms.

Ready to get started?

Our step-by-step guides walk you through implementing Essential Eight ML1 in Microsoft 365 or Google Workspace - written for people who aren't security specialists.

Microsoft 365 guide Google Workspace guide