--- title: "Essential Eight for WA Government Contractors | StartCloud" description: "What the WA Government Cyber Security Policy means for ICT suppliers and contractors. Reach Essential Eight Maturity Level One, prove it, and stay tender-ready." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://startcloud.au/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://startcloud.au/cybersecurity" }, { "@type": "ListItem", "position": 3, "name": "Essential Eight", "item": "https://startcloud.au/cybersecurity/essential-eight" }, { "@type": "ListItem", "position": 4, "name": "WA Government Contractors", "item": "https://startcloud.au/cybersecurity/essential-eight-wa-government" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does the WA Government Cyber Security Policy apply to my business as a supplier?", "acceptedAnswer": { "@type": "Answer", "text": "The policy itself binds WA government entities: public sector agencies, Schedule 1 entities, universities, and Government Trading Enterprises. It does not directly bind every supplier. In practice, though, agencies pass security expectations down to the providers who handle their data and systems, through tender questions, contract clauses, and risk assessments. If you work with or for WA government, you should expect to be asked how you meet the Essential Eight." } }, { "@type": "Question", "name": "What maturity level does WA government expect?", "acceptedAnswer": { "@type": "Answer", "text": "The WA Government Cyber Security Policy 2024 aligns to the ACSC Essential Eight at Maturity Level One (the November 2022 model), alongside components of the NIST Cyber Security Framework and an additional set of controls the state calls the Further Five. Maturity Level One is the baseline expectation for in-scope entities." } }, { "@type": "Question", "name": "Do I need to be Essential Eight compliant to be on the CUAICTS2021 panel?", "acceptedAnswer": { "@type": "Answer", "text": "Not as a blanket requirement. Being on the ICT services Common Use Arrangement (CUAICTS2021) does not currently make Essential Eight a mandatory tick-box for contractors. What does happen is that individual agencies assess risk per engagement, insurance levels scale with that risk, and security maturity increasingly features in how bids are evaluated. Demonstrating Essential Eight alignment makes you a stronger, more credible contractor." } }, { "@type": "Question", "name": "How long does it take to reach Maturity Level One?", "acceptedAnswer": { "@type": "Answer", "text": "It depends on where you start. A business with MFA, decent patching, and tested backups already in place can often close the remaining gaps in a matter of weeks. One starting closer to Maturity Level Zero should plan for a few months of staged work. We give you a realistic timeline after the initial gap assessment, not a guess." } }, { "@type": "Question", "name": "Can you provide evidence we can show an agency or auditor?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. We build documentation and reporting as part of the work: what control is in place, how it is configured, and how it is maintained. The point is that when an agency, auditor, or tender panel asks, you have clear evidence ready rather than having to reconstruct it under pressure." } }, { "@type": "Question", "name": "We are a small business. Is Essential Eight realistic for us?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, and it is designed to be. Most WA government suppliers are small and medium businesses, not enterprises. We size the work for teams of 10 to 200 staff so you can be genuinely credible on security without an enterprise budget or an in-house security team." } } ] }, { "@context": "https://schema.org", "@type": "WebPage", "url": "https://startcloud.au/cybersecurity/essential-eight-wa-government", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "#loc-hero h1", "#loc-hero p", "#loc-services h2" ] } }, { "@context": "https://schema.org", "@type": "Service", "serviceType": "Essential Eight Compliance for WA Government Suppliers", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "areaServed": { "@type": "Place", "name": "Western Australia" }, "description": "Essential Eight gap assessment, implementation, and compliance evidence for Perth ICT suppliers and contractors who work with WA Government agencies under the WA Government Cyber Security Policy." } ] ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Overview Services Why Us What the WA Government Cyber Security Policy Actually Requires What This Means If You Sell To or Service WA Government The Eight Strategies, in Plain English How We Get You Tender-Ready Testimonials FAQ Get Started StartCloud helps Perth ICT suppliers and contractors meet the cyber security expectations of the WA Government Cyber Security Policy 2024, which holds state agencies, universities, and Government Trading Enterprises to the ACSC Essential Eight at Maturity Level One. The policy does not blanket-mandate Essential Eight for suppliers, but agencies flow those expectations down through tender questions, contract clauses, and risk assessments (including on the CUAICTS2021 ICT services panel). Services include Essential Eight gap assessments, implementation to Maturity Level One, compliance and evidence documentation, 24/7 SOC monitoring, and penetration testing, from a Balcatta-based managed security service provider. - [Home](/) - [Cybersecurity](/cybersecurity) - [Essential Eight](/cybersecurity/essential-eight) - WA Government Contractors Essential Eight for WA Government # Essential Eight for WA Government Contractors & Suppliers If you sell to, or run systems for, Western Australian government agencies, their security expectations land on you too. The WA Government Cyber Security Policy holds agencies to the [ACSC Essential Eight](/cybersecurity/essential-eight), and that flows down to the contractors and suppliers who handle their data. We help Perth businesses meet Maturity Level One and prove it, so security strengthens your next bid instead of sinking it. [Get a Free Security Assessment](/contact)[View Our Services](#loc-services) What We Offer ## How We Help WA Government Suppliers [ ### Essential Eight Gap Assessment An honest read of where you sit against all eight strategies today, mapped to Maturity Level One, with a plain-English list of what needs closing. ](/cybersecurity/essential-eight)[ ### Implementation to Maturity Level One We do the unglamorous work: application control, patching, macro settings, hardening, admin restriction, MFA, and tested backups. ](/cybersecurity/essential-eight)[ ### Compliance & Risk Management Evidence, documentation, and reporting you can hand to an agency, an auditor, or a tender panel without scrambling. ](/cybersecurity/compliance)[ ### 24/7 SOC Monitoring Round-the-clock threat monitoring from our Security Operations Centre, so someone is watching the alerts your clients expect you to watch. ](/cybersecurity/soc)[ ### Penetration Testing Independent testing that finds the exploitable gaps before an attacker or an agency's security review does. ](/cybersecurity/pentesting)[ ### Virtual CIO for Tender Readiness Strategic help getting your security posture, policies, and evidence into shape ahead of a bid or a contract renewal. ](/technology/vcio) The StartCloud Difference ## Why StartCloud ### We Understand WA Public Sector Expectations We work with the frameworks the state actually uses: the ACSC Essential Eight, the WA Government Cyber Security Policy, and the risk questions that come up in ICT procurement. ### Security-First, Not Security-Later We are a managed security service provider (MSSP), not an MSP that bolts security on afterwards. Essential Eight is core work for us, not a side project. ### Evidence You Can Actually Show Meeting a maturity level is one thing. Proving it to an agency or an auditor is another. We build the documentation as we go so you are never caught short. ### Right-Sized for SMB Suppliers Most WA government suppliers are not enterprises. We size Essential Eight work for businesses of 10 to 200 staff who need to be credible without an enterprise budget. ## What the WA Government Cyber Security Policy Actually Requires The Western Australian Government Cyber Security Policy 2024 sets a baseline that state entities are expected to meet. It aligns to the Australian Cyber Security Centre's [Essential Eight](/cybersecurity/essential-eight) at Maturity Level One (the November 2022 model), draws on components of the NIST Cyber Security Framework, and adds a further set of controls the state refers to as the Further Five. It applies to a broad group: public sector agencies under the Public Sector Management Act 1994, Schedule 1 entities, the state's universities, and Government Trading Enterprises. The policy is overseen by the Office of Digital Government (DGov) and its Cyber Security Unit. Progress has been steady rather than instant. When the Office of the Auditor General examined implementation in 2023, none of the ten entities it audited had reached Maturity Level One across every one of the eight controls. That is worth knowing, because it tells you the bar is real, it is being measured, and it is not something agencies are quietly ignoring. ## What This Means If You Sell To or Service WA Government Here is the honest version, because there is a lot of loose talk about this. The policy binds government entities, not every business that sells to them. Being on the state's ICT services panel, CUAICTS2021, does not currently make Essential Eight a blanket, tick-this-box requirement for contractors, and anyone telling you otherwise is overstating it. What is true is more practical. When an agency has to meet a maturity level, that expectation flows downhill to the providers who touch its data and systems. It shows up as security questions in a tender, as clauses in a contract, as a risk assessment before you are handed access, and as insurance levels that scale with the risk of the work. If you host, support, or build systems that hold government information, you should expect to be asked how you protect it. So Essential Eight is less a gate you must pass and more the difference between a credible bid and an awkward one. Being able to say, plainly and with evidence, that you meet Maturity Level One is fast becoming the price of being taken seriously for government-adjacent work in WA. Getting there early is a competitive advantage while others are still scrambling. ## The Eight Strategies, in Plain English The Essential Eight is not mysterious. It is eight practical things done properly and kept up: - **Application control:** only approved software is allowed to run. - **Patch applications:** fix known holes in your programs quickly. - **Configure Microsoft Office macros:** block the ones that carry malware. - **User application hardening:** switch off the risky features attackers abuse. - **Restrict admin privileges:** fewer keys to the kingdom, checked regularly. - **Patch operating systems:** keep Windows and servers current. - **Multi-factor authentication:** a second step so a stolen password is not enough. - **Regular backups:** tested backups you can actually restore from. Want a quick read on where you stand? Our free [Essential Eight self-assessment checklist](/cybersecurity/essential-eight-checklist) runs through 24 plain questions aligned to Maturity Level One. No email required. ## How We Get You Tender-Ready **Start with an honest assessment.** We map you against all eight strategies at Maturity Level One and show you exactly where the gaps are, in priority order. No fear, no upsell, just a clear picture. **Close the gaps in the right order.** Some controls are quick wins, others take planning. We sequence the work so your posture improves fast and the disruption to your team stays low. **Build the evidence as we go.** Meeting a control is only half of it. We document what is in place so that when an agency or auditor asks, you have the answer ready rather than a fortnight of scrambling. **Keep it maintained.** Maturity is not a certificate you frame on the wall. Patches lapse, staff change, and configurations drift. Our [managed security service](/cybersecurity/mssp) keeps your controls current so you stay credible at the next renewal, not just the first bid. What Our Clients Say ## Trusted by Australian Businesses "StartCloud has simplified the way we manage our subscriptions and services. Everything is organised in one place, helping us stay on top of renewals while keeping our business secure and up to date." Ana Carusi "I can express our gratitude for your exceptional IT support throughout the year 2024. Thank you for being a reliable partner, and we look forward to continuing our collaboration in the following years." Fellipe Godinho "StartCloud developed our website exactly as we asked and provide exceptional IT services! Highly recommend them to anyone looking for anything IT." Jake Barrett "Alex, Jason, John and the team are solution providers. They provide a high quality and responsive service you can trust." Josh Tilley FAQ ## Frequently Asked Questions ### Does the WA Government Cyber Security Policy apply to my business as a supplier? ### What maturity level does WA government expect? ### Do I need to be Essential Eight compliant to be on the CUAICTS2021 panel? ### How long does it take to reach Maturity Level One? ### Can you provide evidence we can show an agency or auditor? ### We are a small business. Is Essential Eight realistic for us? ## Getting Ready for a Government Bid or Renewal? Book a free Essential Eight gap assessment. We'll show you exactly where you sit against Maturity Level One and what it takes to be tender-ready, with no jargon and no pressure. [Book a Free Gap Assessment](/contact) ### Related Topics Essential Eight WA government Essential Eight compliance WA WA Government Cyber Security Policy Essential Eight contractors WA Essential Eight Maturity Level One CUAICTS2021 cyber security WA government ICT supplier security ACSC Essential Eight Perth government tender cyber security WA DGov cyber security policy ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution