Swim Between the Flags: The Essential Eight for People Who Run a Business From a Laptop

A distress flag became the safest place on the beach. Eight things became the safest place on your laptop. Same country, same idea.

---

Do you know why the flags are red and yellow?

Most people don't. I didn't, until this week. In 1855 an international code of signals was drawn up for ships at sea, one flag per letter, so a ship could speak to a stranger across open water. The letter O was a flag split diagonally, red and yellow. It meant one thing. Man overboard.

For eighty years that flag lived on ships. Then, in 1935, Australia's surf lifesavers took it down to the sand. Until then the patrol flags on our beaches had been blue and white. From 1935 they were red and yellow, borrowed almost certainly from the ship's signal for someone in the water, and planted in a pair, with a stretch of ocean between them where the lifesavers had decided you'd be safe.

Think about what that is. They took the flag that means "someone's drowning" and turned it into the place where you don't.

Three years later, on 6 February 1938, three huge waves rolled into Bondi and hundreds of swimmers went out with the sandbank. More than two hundred were pulled back to shore. Five men died. They still call it Black Sunday. It was the biggest mass rescue in surf lifesaving's history, and the flags were three summers old.

The flags held. The world's lifesaving federation now recommends the same two colours for every beach.

I find this level of preparation admirable.

Now hold that thought, because seventy-five years after the lifesavers took a distress flag down to the beach, the same country did the same thing again, on a very different kind of water.

Not the break-ins. The doors.

In 2010, in a building in Canberra you will never be invited into, a small group of people sat down with a stack of break-in reports and started counting.

Not the break-ins. The doors.

They were the ones sent in after every intrusion into a government network to work out how it had happened, and like lifesavers watching a rip, they'd noticed that people kept getting pulled out at the same few spots. So they wrote a list, thirty-five things, and ranked it by one question: had this been done, would the intruder have got in?

Four rose to the top. ASD said at the time that at least 85 per cent of the intrusions it responded to could have been prevented by those four. In 2017 the four became eight, and the list got the name it has today. The Essential Eight. Eight flags, and a stretch of safe water between them.

Here's the part nobody mentions, and it's my favourite. Beside every strategy in the full table, they wrote three more things: what it would cost to set up, what it would cost to keep going, and how much the people using the computers were going to hate it. Low, medium, high, next to every line. They weren't selling anything. They knew a thing nobody can afford, or nobody will put up with, doesn't get done. So they told you the price, and put the whole thing on cyber.gov.au for nothing.

Nobody has ever been examined on the flags. Nobody pays to walk between them.

Though I suspect someone is drafting the certificate.

One thing before we go on, because it matters. I run a cybersecurity membership. I have skin in this. That's exactly why you're getting everything free first, and why I'll say plainly when we reach the part that isn't.

Then the list left the building.

6:40 on a Tuesday

It's 6:40 on a Tuesday. Something's in the pan. Your phone rings from a number you don't know and, against your better judgement, you answer it.

"Hi, is that the business owner? I'm calling about the Essential Eight. Have you had your assessment done? We can get you a maturity level for a thousand dollars, and a lot of insurers are asking for it now."

Here's what happened between Canberra and your kitchen. The government made the list mandatory for its own agencies and published a ruler alongside it, level zero to level three, so an organisation with a thousand computers could measure how thoroughly it had done the eight. The ruler was built for a building with a lift. Then the ruler got out. It turned up on insurance renewals as a page of questions. It turned up in tenders as a clause. And then somebody noticed that a ruler built for large networks, held up against a five-person business, finds gaps every single time. Gaps become a report. A report becomes a proposal. A proposal becomes a retainer.

The thousand dollars was never the price. It was the appointment.

And here's the thing the caller won't tell you, because it rather spoils the pitch. Every year ASD measures the government's own entities against that ruler, the buildings it was built for, with the IT floors and the budgets. In 2025, 22 per cent of them reached Level 2, the level they're required to reach. The year before, it was 15. So a report that finds gaps in your business for a thousand dollars will certainly find them. It finds the same gaps at the Department of Nearly Everything. That's not a verdict on you. It's a starting line, and it's where almost everyone starts, including the people who wrote the list.

You can hang up now.

Here's what I've learned about the people who sell rulers. You can't control them. You can control the flags.

I can't make a form clearer or a consultant stop calling, and neither can you. But do the eight things, and your answers on the form are true and the call is short. That isn't my opinion, it's Canberra's. ASD's own guides for small business say they apply the principles of the Essential Eight and are not designed for organisations looking to meet a specific maturity level. The people who wrote the list, telling a small business: do the things. Don't chase the level.

If nobody has asked you for a maturity level in writing, you don't need to pay for a maturity-level report. What matters is that every yes you give is true.

The quiet day

I know what you're thinking, because it's what I'd be thinking. You've run your business for years without any of this, and nobody has dragged you out to sea. I'm not going to argue with that.

But go back to Bondi for a moment. The people on that sandbank in 1938 weren't reckless. It was a Sunday, the sun was out, the water had been calm for hours. Most of them walked home that evening, and the reason most of them walked home is that the lifesavers were standing exactly where the flags said they'd be.

You've been swimming on a quiet day. There have been a lot of quiet days on your stretch. ASD's most recent threat report counts one cybercrime report every six minutes, from businesses of every size, and the reports aren't written about careless people. They're written about people who were swimming on what had always been a quiet stretch.

Luck is a real thing. It's just not a plan.

The eight

So here are the eight, and under each one, the thing to do tonight, or the thing to ask whoever looks after your computers.

Keep the computer updated. Open Windows Update, or Software Update on a Mac, and look at the date of the last one. If it's more than a fortnight old, press the button. I once watched a man press "remind me tomorrow" for eleven consecutive months. He now features in a case study. The update isn't just the fix. It's the announcement of the flaw.

Keep your programs updated too. Canberra counted this separately, because the browser and the Office suite are where the spreadsheets and links arrive. Let them update themselves. They will, if you stop closing the prompt.

Use the second code when you log in. Start with email tonight, because that's where your invoices come from and every other password reset goes. It's under Security in Microsoft 365 or Google Workspace, it takes ten minutes, and an app on your phone or a key on your keyring beats a text message.

Don't run your day as the administrator. Make a second, ordinary account and live in it. The one that can install anything is for installing things. If someone gets your everyday password, they get an everyday account, and an everyday account can't install their software either.

The update isn't just the fix. It's the announcement of the flaw.

Turn off macros from outside your business. In Word or Excel, under Options, then Trust Centre, block macros in files from the internet. One setting. And treat any document that asks you to enable one with suspicion, whoever it seems to be from, because whoever breaks into your accountant's email will use your accountant's name.

Strip your browser of what you don't use. Open its extensions page and remove anything you don't remember adding on purpose. That's most of it, and it takes less time than reading this paragraph.

Only let known software run. Canberra rated this one high for setup cost and put it at the top of the essentials anyway. On a Windows 11 laptop, turn on Smart App Control under Windows Security; it's the free approximation, and it's a good one. The full version, the one that watches every program that tries to start, is harder. Hold that thought. It's the part I said I'd name plainly, and it's coming.

And keep a backup. Tested. Tested means: pick one file you'd hate to lose, restore it from the backup into a different folder, and open it. Do that once a season.

A backup you've never restored from is a hypothesis, not a safety net.

That's the eight. Most are yours tonight or one conversation away. None of them requires a report.

Different flags, same rip

One more thing, and it's the reason I'm sure about all of this.

Remember the flags being recommended beyond Australia? The list was too. Britain has Cyber Essentials. New Zealand has the Critical Controls. Canada has its Baseline Controls. The United States has two lists from two agencies. Singapore launched a certificate in 2022 and, of all the names it could have chosen, called it Cyber Essentials too. Seven agencies, six countries, each with its own list, and side by side they overlap almost entirely. Updates, the second code, the admin account, the backup.

The flags on your beach may be a different colour. The rip is the same.

What you can control

So here's what you can control. Three things.

The first is the eight. You've just done, or scheduled, most of them. The rest is at cyber.gov.au, and our own guides at WISECLICK walk each one in plain language, free, because a guide to something free shouldn't cost money either.

The second is the part I said I'd name plainly. This is it. Two of the eight are hard to do alone: a backup that can't be deleted by whoever is holding your keyboard, which the eight require at their very first level, and something watching every program that tries to start on your machine, including while you sleep. For a one-laptop business, that's what a WISECLICK membership is. We set both up, we watch them, and you have a person to ask. It costs about what a couple of coffees a week cost, and the door is at wise.click.

The third is someone in your corner who knows your business. Because the next ruler won't ring at 6:40. It'll arrive as a renewal form on an ordinary Tuesday, asking whether your backups are immutable, and you won't know what that word means in their sentence. You don't guess. You send it to us and we read it with you. Members ask. That's the whole arrangement.

The flags were always free.

They started as a signal that someone was in the water. They became the place where nobody has to be.

---

Frequently asked questions

Is the Essential Eight mandatory for my small business?

No. It's mandatory for Australian Government entities. For everyone else it's ASD's recommended baseline, published free at cyber.gov.au. Where it starts to feel mandatory is second-hand: an insurer's renewal form, a tender, a large customer's supplier questionnaire. None of those require a maturity level unless they say so in writing.

Do I need to pay for an Essential Eight assessment?

Only if someone has asked you, in writing, for a maturity level: a department you supply, a defence contract, a tender clause. If nobody has, you don't need the report. You need the eight things done and every yes on your renewal form to be true. Our own Cyber Report Card uses the government's scale as a starting line, and almost everyone lands at Level 0, which is not a verdict. The value isn't the number. It's the about 20 minutes of questions and the short list of what to do first. It's ours, and it costs $149.

What's the difference between the Essential Eight and the Maturity Model?

The Essential Eight is the list: eight things. The Maturity Model is a ruler, levels zero to three, for measuring how thoroughly a large organisation has done them. ASD's own small business guides apply the principles of the eight and say plainly they're not designed for reaching a specific maturity level. Do the things. Don't chase the level.

Does my cyber insurance require the Essential Eight?

Most Australian cyber policies now ask questions drawn from it: multi-factor authentication, admin privileges, backups, updates. The form is a declaration, not an exam. What matters is that every yes is true, because a yes that turns out to be "sort of" is the problem that surfaces on claim day. If a question on your form doesn't make sense, ask before you tick it. Members send theirs to us.

Is the Essential Eight only for Australia?

The list is Australian, written by ASD. But the UK, New Zealand, Canada, the United States and Singapore have each published their own baseline, and side by side they overlap almost entirely. Updates, the second code, the admin account, the backup. Different flags, same rip.

How much does the Essential Eight cost?

For a one-laptop business, most of it is time, not money: an evening for updates, the second code, a separate admin account, macros and browser hygiene. ASD's own table rates each strategy for cost and for how much users push back, and it's honest that application control is expensive to set up. That one, and a backup that can't be deleted, are the two that usually need a service behind them. Everything else is free.

I'm a sole trader with one laptop. Does any of this apply to me?

All of it, and in your favour. One laptop is the easiest place on earth to do the eight, because there's one computer to update, one email to protect and one backup to test. The list was written for departments with thousands of machines. You'll get through it faster than they ever did.

---

Stay protected, my friends.

— The Most Secure Man Alive