Module 7 of StartCloud's Essential Eight for Australian Business pathway, in five short units with a knowledge check: a suggested implementation order sequenced by protection gained per dollar and per disruption, which controls a Microsoft 365 Business Premium licence already covers versus what is a genuine extra cost, a realistic ninety day plan starting with assessment and the free wins, and the four common ways an Essential Eight program derails.
Where to Actually Start
The order that actually works
ASD lists the eight in its own order, but that list is not a project plan. If you are starting from Level Zero with a real budget and a business to run, the practical question is which one to touch first.
This is our suggested order, not an official one. It is sequenced by protection gained per dollar and per disruption caused, which is how most businesses should think about it.
- 1
Multi-factor authentication
Highest protection for the least money and disruption, and the one an insurer asks about first. If you have done the Microsoft 365 pathway this is already behind you.
- 2
Restrict administrative privileges
Costs nothing but a careful afternoon and a bit of discipline afterwards. It also quietly limits the damage of almost every other failure, which is why it earns its place early.
- 3
Regular backups, tested
You may already have backups. What you probably do not have is a tested restore and a record of it. This is the control an assessor can check in ten minutes, so it is worth being genuinely ready.
- 4
Patch applications, then operating systems
Mostly a process problem rather than a product one. Decide who is responsible, decide how quickly, and get visibility of what is actually installed rather than what you think is.
- 5
Restrict Microsoft Office macros
Usually a policy change rather than a purchase. The hard part is finding the one spreadsheet in accounts that genuinely needs macros, and handling it as a documented exception.
- 6
User application hardening
Browser and reader settings, mostly configuration. Fiddly across a fleet without device management, which is why it tends to arrive alongside a tool rather than before one.
- 7
Application control
Last, deliberately. It is the most disruptive of the eight and the one most likely to stall a program if attempted first. Do it when the other seven are steady.
You are aiming for the same level across all eight. This order is about sequencing the work, not about picking favourites and stopping. Until the seventh one is done, your maturity is whatever the seventh one says it is.
Before anyone quotes you for anything, it is worth knowing how much of this you are already paying for. If your business runs Microsoft 365, particularly on a Business Premium licence, a meaningful slice of the Essential Eight is sitting there switched off.
- Multi-factor authentication, on every Microsoft 365 plan
- Admin role separation, so nobody works day to day as Global Admin
- Policy control over Office macros
- Device management to push settings and updates, on Business Premium
- A real backup product, since Microsoft 365 does not back your data up for you
- Patch management across third-party applications, not just Windows
- Application control tooling and the time to build the rules
- Somebody's time, which is the cost people forget to count
Owning a licence that can do something is not the same as having it configured, applied to everyone, and evidenced. Assessors look at what is actually enforced, not what you are entitled to. Plenty of businesses discover they have been paying for the capability for years without switching it on.
A plan that fits in a quarter is a plan people actually finish. This is deliberately unambitious, and it will move a typical business a long way from where it started.
Run the honest self-assessment from module 2 across all eight. Write down what is actually in place, not what is intended. Name an owner for each control, even if the owner is you or your provider.
MFA everywhere, admin privileges separated and reduced, macro policy set. These need decisions and communication far more than money, and they move you off Level Zero on three controls.
Confirm what is actually being backed up, run a real restore, and write down the date and the result. If a restore has never been tested, assume it does not work until it has been.
Visibility first, then a documented process with an owner and a timeframe. This is the one that quietly slides if nobody is accountable, so put it in a calendar rather than in someone's head.
Notice what is not in the ninety days: application control and user application hardening. Those are the two that need tooling and testing, and starting there is the most reliable way to end the quarter with nothing finished. They come next, once the cheap wins are banked and the habit exists.
Most Essential Eight programs do not fail on technology. They fail in fairly predictable, human ways, and knowing them in advance is most of the cure.
Application control is the one people have heard of, so it is where enthusiasm goes first. It is also the most disruptive, and three months of arguing about it is how a program dies before it delivers anything.
"IT is handling it" is not ownership, particularly when IT is a provider with a support contract rather than a project brief. Each control needs a named person and a date, including the ones you outsource.
Patching, backup testing and privilege reviews are not things you finish. A business that reached Level One and then stopped paying attention is usually back at Level Zero within a year without noticing.
Tools help, but no purchase decides who is allowed to be an admin, or how quickly you patch. Those are business decisions, and skipping them means the tool arrives and nothing changes.
- cyber.gov.au: Essential Eight maturity model (Australian Signals Directorate)
- cyber.gov.au: Essential Eight explained
The sequencing and the ninety day plan in this module are StartCloud's practical suggestion, not ASD guidance. ASD sets out what each maturity level requires and leaves the implementation order to you. Licence capabilities were current at the time of writing (August 2026).
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. Which control is usually the sensible one to tackle first?
2. Your business has Microsoft 365 Business Premium. What does that mean for the Essential Eight?
3. Which of these is genuinely an extra cost rather than something you probably already own?
4. What is the most common way an Essential Eight program derails?
5. You reached Level One across all eight last year and have not looked since. Where are you now?