The ACSC Essential Eight, translated for a one-van trade business

The Essential Eight is the Australian Cyber Security Centre's baseline set of controls for reducing cyber risk — written primarily for organisations with an IT department, which means most of it doesn't obviously translate to a business run out of a ute. Here's what each control actually means at that scale.

What does "application control" mean for a solo tradie?

Only install apps from your phone's official app store (Google Play / Apple App Store), not sideloaded APKs or links texted to you. That single habit covers most of what this control is trying to achieve at a 1-3 person scale.

What does "patch applications" mean day to day?

Turn on automatic updates for your phone, laptop, and job-management app, and don't put off the update prompts. Most real-world breaches exploit a vulnerability that was already patched months earlier — the gap is people delaying the update, not a lack of a patch existing.

What does "multi-factor authentication" actually protect?

Your Xero login, your email, your job-management system, and your bank login are the four that matter most. If someone else could send an invoice, read a client's details, or move money by getting into one of those four accounts, MFA on that account is worth the ten seconds it adds to logging in.

What does "regular backups" mean if you don't run a server?

Whether your job photos, quotes, and client details actually survive your phone being lost, stolen, or dropped in a puddle on site. If the honest answer is "they're only on my phone," that's the gap — most job-management apps already back up to the cloud automatically; check the setting is actually on.

What does "restrict admin privileges" mean with one or two staff?

Not every staff member needs the login that can change bank details, delete client records, or add new users. If your job-management system supports staff-level permissions, a new apprentice's login shouldn't have the same access as yours.

The remaining three controls (configuring Microsoft Office macro settings, user application hardening, and restricting admin OS environments) are genuinely IT-department-scale and rarely apply to a business with no server infrastructure — worth knowing they exist, not worth chasing at this size.