The Essential Eight is a set of eight cyber security strategies from the Australian Signals Directorate (ASD) that helps prevent attacks and recover from incidents. For a small mortgage brokerage, it provides a practical way to organise security across laptops, email and the customer relationship management system (CRM). Start with a risk-based target of Maturity Level One unless your risks or contractual obligations call for more.
What the Essential Eight is
The Essential Eight combines controls that reduce opportunities for an attacker with backups that support recovery. ASD’s Essential Eight explanation lists the eight strategies and explains their intended use on internet-connected IT networks.
The maturity model describes how thoroughly those strategies are implemented. Buying a security subscription does not establish a maturity level. The settings and their coverage across your systems determine the result.
Consider a hypothetical brokerage with four laptops and a cloud CRM. Updating every laptop helps close known software weaknesses. Restricting administrator access limits what a compromised everyday account can change. Recoverable backups help the business resume work if files are damaged. Each control addresses a different part of the incident.
The Essential Eight is one part of security management. Your brokerage still needs staff reporting procedures and a response plan. A suspicious message needs attention even when technical controls are in place.
The Eight Controls in a Small Brokerage
Apply all eight controls to the systems your brokerage uses, with a named person responsible for each one. The following examples translate the controls into brokerage tasks. They are a starting checklist, not a complete maturity assessment.
ASD’s mitigation guidance explains why controls such as approved application lists and restricted privileges reduce attack opportunities.
| Control | Brokerage task | Evidence to keep |
|---|---|---|
| Patch applications | Manage updates for browsers, PDF readers, office software and any installed CRM client. Include browser extensions in the inventory. | An application inventory and a report showing outstanding updates. |
| Patch operating systems | Manage laptop and desktop operating system updates. Replace unsupported systems and identify who updates network equipment. | Device coverage, operating system versions and update results. |
| Multi-factor authentication | Require another authentication factor for work email and the CRM. Include administrator accounts and remote access in the review. | Enforcement settings and account coverage, with enrolment details kept private. |
| Restrict administrative privileges | Give staff everyday accounts for ordinary work. Use separate administrator accounts for authorised changes and remove access when duties change. | A list of privileged accounts and the reason each person needs access. |
| Application control | Permit approved software to run on work devices. Trial the rules against your actual broker workflow before enforcing them across the team. | The approved application rules and a safe test showing an unapproved application is blocked. |
| Restrict Microsoft Office macros | Disable macros for staff who do not need them. Document any genuine spreadsheet requirement and manage it through IT. | The enforced macro policy and approved exceptions. |
| User application hardening | Reduce unnecessary browser and document-software functions. Apply managed settings so staff cannot casually undo the protection. | Configuration settings and a check on a staff device. |
| Regular backups | Define what must be recoverable, including client documents and CRM records. Test a restoration without overwriting working files. | Backup results, retention settings and the outcome of a restore exercise. |
For Microsoft 365 or Google Workspace, separate your responsibilities from the provider’s. Record who controls user access and account settings. For a hosted CRM, obtain evidence about provider-managed controls and establish how your own records can be recovered.
If staff use only Google Workspace, record whether Microsoft Office is installed anywhere before marking its macro control as inapplicable. A broker’s old laptop can change that answer.
Which Maturity Level to Aim for
Maturity Level One is a reasonable initial target for many small brokerages, subject to their risk assessment and contractual requirements. ASD’s maturity model FAQ identifies Level One as potentially suitable for small and medium enterprises. Company size alone does not decide the target.
| Level | What it means for the target |
|---|---|
| Zero | The implementation does not meet Level One requirements. |
| One | Controls address common, opportunistic attacks using readily available methods. |
| Two | Controls address attackers investing more effort in bypassing protection and targeting credentials. |
| Three | Controls address more capable attackers who adapt their methods to the target. |
Use the Essential Eight maturity model to assess the actual requirements. Aim for the same level across all eight strategies before advancing. Seven strong controls cannot establish Level One if the remaining strategy fails its requirements.
Level Two involves more than changing a policy heading. Its requirements include phishing-resistant authentication for users of online services and systems, wider application control coverage and central event logging. Privileged administration also needs separate operating environments and access through jump servers, which are systems used to administer other systems.
A small brokerage targeting Level Two needs technical design and evidence for those requirements. A passkey deployment alone does not establish Level Two. It can still be sensible to adopt phishing-resistant authentication while completing Level One, avoiding a later replacement of weaker methods.
Essential Eight Compliance and Assessments
Essential Eight compliance means meeting a defined set of maturity requirements for a defined system. The model itself does not create a broker-specific licence requirement. An aggregator agreement, licensee policy or insurance application can set separate obligations and questions.
When a questionnaire asks whether the brokerage has multi-factor authentication, establish which accounts its wording includes. When it asks about backups, establish whether it means copies exist or recovery has been tested. Treat these as examples of questions to resolve, not the wording of any particular aggregator’s form.
Answer using the implemented controls and disclose relevant exceptions. A requirement that has been planned but not deployed needs a different answer from an enforced setting.
ASD’s assessment process guide ranks practical testing above configuration screenshots and policy statements. A policy proves what the brokerage intends. A safe blocked-application test demonstrates what the device does.
Keep an assessment folder organised by control. Record the system scope, responsible person and evidence location. Document exceptions with their compensating protection and approval, then assess that protection’s effectiveness. Buying cyber insurance does not replace a missing control.
Separate this assessment from privacy compliance. Where the Privacy Act applies, Australian Privacy Principle 11 requires reasonable steps to protect personal information. An Essential Eight maturity result does not settle every privacy obligation.
A 90-Day Plan
Use the first 90 days to establish coverage, implement the controls and test what works. This is a suggested brokerage work plan, not an ASD deadline or a promise of a maturity level.
- During days 1 to 10, list work devices and online services. Name the person responsible for each, record administrator access and agree the target maturity level. Include home-working devices that handle client information.
- During days 11 to 25, enforce multi-factor authentication and address exposed or unsupported software. Review update reporting so a laptop that misses updates appears as an exception. Confirm that each staff member can still sign in through the approved method.
- During days 26 to 40, separate everyday and administrator accounts. Identify the records the brokerage must recover, establish protected backups and restore a sample into an isolated location. Confirm that the restored record opens and contains the expected information.
- During days 41 to 65, deploy macro restrictions and application hardening. Pilot application control with a staff member who handles the full loan workflow. Resolve legitimate blocked software through the approval process before expanding the rules.
- During days 66 to 80, close gaps in device and account coverage. A control applied to the owner’s laptop must also reach relevant staff devices. Review provider evidence for the hosted CRM and document any unresolved control responsibility.
- During days 81 to 90, assess all eight strategies against the target requirements. Record the actual result and assign remaining work. Repeat failed checks after the relevant settings change before describing the brokerage as meeting the target.
Take the completed control register to the next aggregator or insurer questionnaire. Each answer needs an evidence location and a responsible person, so the brokerage can explain both its protection and any remaining gaps.
