The ACSC Essential Eight is the Australian government's baseline cybersecurity framework. These eight controls, implemented together, make it much harder for adversaries to compromise your systems. Not-for-profits are not exempt from these threats. Charities and community services organisations are frequently targeted precisely because they hold sensitive data and often run leaner IT environments than commercial businesses.

This guide explains what the Essential Eight is, why it matters for NFPs, and how to approach implementation when budget and headcount are tight.

What is the ACSC Essential Eight?

The Essential Eight is a set of mitigation strategies developed by the Australian Cyber Security Centre (ACSC). It is not a compliance standard you certify against in the traditional sense. It is a practical baseline designed to make organisations significantly harder to compromise. The framework is structured around four maturity levels (ML0 to ML3), where ML1 represents the minimum recommended starting point for most organisations.

Together the eight controls address the most common attack vectors: unpatched software, stolen credentials, malicious email attachments, and ransomware.

• 1. Patch Applications Keep third-party software up to date: browsers, Office, PDF readers. Unpatched applications are the most common entry point for attackers.
• 2. Patch Operating Systems Apply OS security patches promptly. At ML1, internet-facing systems must be patched within two weeks of release.
• 3. Multi-factor Authentication Require MFA for all remote access, email, and cloud services. A single compromised password should not be enough to get in.
• 4. Restrict Administrative Privileges Limit who has admin access and what they can do with it. Admin accounts should not be used for day-to-day tasks.
• 5. Application Control Only allow approved applications to run on your systems. Prevents malware and unapproved software from executing.
• 6. Restrict Microsoft Office Macros Block or tightly control Office macros, a common delivery vehicle for malware via email attachments.
• 7. User Application Hardening Disable features in browsers and applications that attackers commonly exploit: ads, Java in browsers, and unnecessary plug-ins.
• 8. Regular Backups Back up data, applications, and configuration settings regularly. Test that backups can actually be restored, and keep at least one offline copy.

Why NFPs need to take this seriously

Not-for-profit organisations hold significant amounts of sensitive information: donor financial records, beneficiary personal data, employee files, grant documentation, and often health or welfare details. Under the Privacy Act, organisations with annual turnover above $3 million have obligations around how that data is stored, protected, and disclosed. Many NFPs are approaching or already past that threshold.

Beyond legal obligation, the reputational risk of a data breach for a charity is disproportionately severe. Donor trust is hard-won and quickly lost. A ransomware incident that locks your systems during a campaign or emergency response is not just an IT problem. It is an organisational crisis.

How the Essential Eight applies to a small or mid-size NFP

ML1 is the appropriate starting point for most organisations, regardless of size. For NFPs using Microsoft 365, many of the controls are already included in your licensing and can be configured within the Microsoft 365 admin centre without additional cost. The gaps are usually in application control, macro restrictions, and admin privilege management , all straightforward to address with the right configuration.

The recommended approach for NFPs starting their Essential Eight journey:

• Assess your current state. Map each of the eight controls against your environment honestly. Identify where you are at ML0 versus ML1.
• Prioritise by impact. MFA and patching deliver the most risk reduction per dollar of effort. Start there.
• Close the quick wins. MFA, patch schedules, and backup testing can usually be addressed in weeks, not months.
• Plan the longer-term controls. Application control and privilege management require more planning but are achievable over 6 to 12 months.
• Test and validate. The Essential Eight is not a one-time project. It requires ongoing maintenance as systems change and new vulnerabilities emerge.

How All IT approaches this with NFP clients

All IT works with not-for-profit organisations across Australia to assess their current Essential Eight maturity, close the most critical gaps, and maintain ongoing compliance , without requiring a dedicated internal security team. Our average client stays for over 10 years, and we operate on month-to-month contracts with no lock-in. NFPs should not be tied to a provider that is not delivering.

If your NFP wants to understand where it sits against the Essential Eight and what it would take to reach ML1, get in touch with the All IT team. No sales process, no jargon, just a straight assessment.

Frequently Asked Questions

---

All IT Services works with not-for-profit organisations across Australia to implement the ACSC Essential Eight: practically, affordably, and without requiring a dedicated internal IT team.